CVE-2025-66028: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66028 is a privilege escalation vulnerability in OneUptime, an open-source service monitoring and management platform, caused by improper trust in client-controlled login response parameters. Prior to version 8.0.5567, the server's login response included a parameter isMasterAdmin that was not validated server-side, allowing any authenticated user to intercept and modify this value from false to true to gain access to the admin dashboard interface. The vulnerability was reported by researcher SamirWaleed and published on November 25, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-284 (Improper Access Control) and CWE-863 (Incorrect Authorization): the application relied on a client-supplied isMasterAdmin flag in the login response JSON rather than enforcing admin status server-side via JWT validation. An attacker with a valid account could use an HTTP interception proxy (e.g., Burp Suite) to modify the login response, flipping "isMasterAdmin": false to "isMasterAdmin": true, which caused the frontend to render the admin dashboard. The fix introduced server-side JWT decoding in AdminDashboard/Serve.ts via an ensureMasterAdminAccess function that validates the isMasterAdmin claim from the JWT token before serving the admin frontend, ensuring the check cannot be bypassed by client-side manipulation (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to access the OneUptime admin dashboard interface without legitimate master admin privileges. However, the practical impact is partially mitigated by backend permission controls — while the admin UI becomes visible, the attacker may be unable to view or interact with sensitive monitoring data if their account lacks the underlying data permissions. The primary risk is unauthorized visibility into the admin panel structure, potential information disclosure of dashboard metadata, and a low-integrity impact from unauthorized access to administrative interface elements (GitHub Advisory).

1. Obtain a valid account: Register or log in to a OneUptime instance running a version prior to 8.0.5567 with any non-admin user account.
2. Set up an interception proxy: Configure a tool such as Burp Suite or OWASP ZAP to intercept HTTPS traffic between the browser and the OneUptime server.
3. Initiate login: Submit login credentials through the OneUptime web interface while the proxy is active.
4. Intercept the login response: Capture the server's JSON login response, which includes the field "isMasterAdmin": false.
5. Modify the parameter: Change the value to "isMasterAdmin": true in the intercepted response before it is forwarded to the browser.
6. Forward the modified response: Allow the modified response to reach the browser; the frontend application will now render the admin dashboard interface.
7. Access admin dashboard: Navigate the admin panel — note that backend data access may still be restricted by server-side permission controls on individual data endpoints (GitHub Advisory).

• Network: Unexpected or repeated login requests followed by navigation to admin dashboard routes (e.g., /admin or /admin-dashboard) from accounts not designated as master admins.
• Logs: Authentication logs showing a non-admin user account successfully accessing admin dashboard endpoints; discrepancies between the user's role in the database and the admin routes accessed.
• Application Behavior: Admin dashboard being rendered for user accounts that are not configured as master admins in the OneUptime database.

OneUptime has released a patch in version 8.0.5567 that enforces server-side JWT validation of the isMasterAdmin claim before serving the admin dashboard, preventing client-side manipulation from granting access. Organizations should upgrade to version 8.0.5567 or later immediately. As a temporary workaround prior to patching, restricting network access to the admin dashboard endpoint to trusted IP ranges can reduce exposure. Additionally, enabling multi-factor authentication and monitoring authentication logs for anomalous admin access patterns is recommended (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher SamirWaleed and published by the OneUptime maintainer (simlarsen) via GitHub's security advisory process on November 25, 2025. A blog post titled "Unmasking OneUptime's Silent Killers: How Two Critical CVEs Expose 100,000 Users to Total System Takeover" was published at undercodetesting.com, suggesting broader community interest in OneUptime's security posture. The vulnerability was also noted by automated CVE tracking accounts on Bluesky. No major vendor statements beyond the GitHub advisory or significant media coverage have been identified.