CVE-2026-30920: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30920 is a broken access control vulnerability in OneUptime's GitHub App installation callback flow that allows unauthenticated attackers to overwrite another project's GitHub App installation binding and create unauthorized CodeRepository records. It affects all OneUptime versions prior to 10.0.19 (npm packages oneuptime and @oneuptime/common). The vulnerability was published on March 6, 2026, and patched in version 10.0.19. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, OneUptime Advisory).

The root cause is a combination of CWE-345 (Insufficient Verification of Data Authenticity), CWE-639 (Authorization Bypass Through User-Controlled Key), and CWE-862 (Missing Authorization). The GitHub App OAuth callback endpoint (/api/github/auth/callback) decodes an unsigned base64-encoded JSON blob from the state query parameter and uses the embedded projectId directly to update Project.gitHubAppInstallationId with isRoot: true privileges — without verifying that the caller owns or is authorized for that project. The userId field in state is only checked for presence, not authenticity, and the state token itself is plain base64 JSON rather than a signed or session-bound value. Additionally, the middleware permits requests with no authentication token to proceed as Public, and installation tokens can be minted from any valid installation_id, making follow-on repository listing and connect endpoints equally exploitable (OneUptime Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to overwrite any project's gitHubAppInstallationId, effectively hijacking or disrupting its GitHub integration (availability impact). Using a valid installation_id, an attacker can enumerate repository metadata across projects (confidentiality impact) and create unauthorized CodeRepository records in arbitrary projects they do not own (integrity impact). This cross-tenant data manipulation could break CI/CD pipelines, expose repository metadata, and enable an attacker to bind their own GitHub App installation to a victim project for persistent access (OneUptime Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, consisting of a minimal two-line bash/curl command that requires no authentication and no special tooling (OneUptime Advisory). The EPSS score is approximately 0.011% (2nd percentile), indicating a low current probability of active exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a target OneUptime instance running a version prior to 10.0.19. Obtain the projectId (a UUID) of the target project — this may be discoverable via the OneUptime UI, API responses, or public dashboards.
2. Craft the malicious state parameter: Construct a JSON object with the victim's projectId and any non-empty userId value, then base64-encode it:

STATE=$(printf '%s' '{"projectId":"<victim-project-id>","userId":"x"}' | base64 | tr -d '\n')

3. Obtain or guess a valid installation_id: A valid GitHub App installation_id can be obtained from any GitHub App installation the attacker controls, or by guessing/enumerating numeric IDs.
4. Send the malicious callback request: Issue an unauthenticated HTTP GET request to the callback endpoint with the crafted parameters:

curl -isk "https://<host>/api/github/auth/callback?installation_id=<installation_id>&state=${STATE}"

5. Observe the result: The server responds with a 302 redirect to /dashboard/<projectId>/code-repository?installation_id=<installation_id>, and the victim project's gitHubAppInstallationId is overwritten with the attacker-supplied value.
6. Enumerate repositories (optional): Use the same installation_id against the repository listing endpoint (GitHubAPI.ts#L179-L258) to enumerate repository metadata for the bound installation.
7. Create unauthorized CodeRepository records (optional): Call the repository connect endpoint (GitHubAPI.ts#L260-L356) to create CodeRepository records in the victim project, establishing persistent unauthorized access to the project's code integration (OneUptime Advisory).

• Network: Unexpected HTTP GET requests to /api/github/auth/callback with state parameters containing base64-encoded JSON where the userId is a single character (e.g., x) or otherwise anomalous; requests originating from IPs not associated with GitHub's OAuth redirect infrastructure.
• Logs: Server access logs showing 302 redirects from /api/github/auth/callback to /dashboard/<projectId>/code-repository for project IDs not initiated by the project owner; repeated callback requests with varying installation_id values suggesting enumeration.
• Application Data: Unexpected changes to Project.gitHubAppInstallationId fields in the database, particularly if the new value does not correspond to a GitHub App installation authorized by the project owner; newly created CodeRepository records in projects whose owners did not initiate a GitHub connection.
• Process/API: Calls to GitHub installation token minting logic (GitHub.ts#L347-L425) for installation_id values not associated with the project's legitimate GitHub App setup (OneUptime Advisory).

Upgrade OneUptime to version 10.0.19 or later, which fixes this vulnerability (GitHub Advisory). No official configuration-based workaround is provided; the recommended remediation is to validate all attacker-controlled state and installation_id values in the GitHub App callback handler, implement proper authorization checks before allowing updates to Project.gitHubAppInstallationId, and enforce authentication on all GitHub-related endpoints. Organizations unable to upgrade immediately should consider disabling the GitHub App integration feature or restricting network access to the /api/github/ endpoints until patching is possible (OneUptime Advisory).

The vulnerability was reported by security researcher maru1009 and published by OneUptime maintainer simlarsen on March 6, 2026 (OneUptime Advisory). Coverage appeared on The Hacker Wire, which published a dedicated technical write-up on the authorization bypass (The Hacker Wire). Social media activity was observed on Bluesky and via CVEnew notifications, indicating moderate community awareness. No significant vendor controversy or widespread media coverage beyond security-focused outlets has been noted.