CVE-2026-30959: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30959 is a WhatsApp Resend Verification Authorization Bypass vulnerability in OneUptime, an open-source monitoring and incident management platform. The flaw allows any authenticated user to trigger a WhatsApp verification code resend for any UserWhatsApp record by supplying an arbitrary record ID, without any ownership validation. It affects all versions of the @oneuptime/common npm package prior to 10.0.21. The advisory was published on March 8, 2026, and assigned a CVSS v4 base score of 5.3 (Medium) (Github Advisory, OneUptime Advisory).

The root cause is a missing authorization check (CWE-862, CWE-285, CWE-639) in the resend-verification-code POST endpoint defined in UserWhatsAppAPI.ts. Unlike the verify endpoint — which explicitly compares item.userId against the authenticated user's ID — the resend path only checks that a non-empty itemId is present in the request body before calling UserWhatsAppService.resendVerificationCode(req.body.itemId). Because the itemId is a user-controlled key, any authenticated project member can supply a victim's UserWhatsApp record ID to trigger repeated verification code deliveries to that victim's phone number. No additional privileges beyond a valid project-scoped access token are required (OneUptime Advisory).

Successful exploitation enables an attacker to flood a victim's WhatsApp-linked phone number with unsolicited verification codes, constituting a spam or denial-of-service attack against the victim's phone. There is no confidentiality or integrity impact — no data is exposed or modified — but repeated resends can create social engineering pressure, disrupt legitimate verification flows, and potentially trigger rate-limiting or lockout mechanisms on the victim's WhatsApp account. The scope is limited to users within the same OneUptime project as the attacker (Github Advisory).

A proof-of-concept exploit is publicly documented in the official security advisory, consisting of a single curl command that any authenticated project member can execute. The EPSS score is approximately 0.02% (6th percentile), indicating low predicted exploitation probability in the near term. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Obtain credentials: Register or obtain a valid OneUptime account with access to the target project, and retrieve a bearer access token.
2. Identify victim's UserWhatsApp itemId: Within the shared project, enumerate or observe the victim's UserWhatsApp record ID (e.g., via project member listings or API responses that expose record IDs).
3. Craft the malicious request: Prepare a POST request targeting the resend endpoint with the victim's itemId:

export ATK="Bearer <attacker-token>"
curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: $ATK" \
  -d '{"itemId":"<victim-userwhatsapp-id>"}' \
  http://<host>/api/user-whats-app/resend-verification-code

4. Trigger repeated resends: Repeat the request in a loop to flood the victim's phone number with verification codes, causing spam, social engineering pressure, or disruption of legitimate verification flows.
5. Observe result: Each request returns HTTP 200 with an empty {} body, confirming a new verification code was dispatched to the victim's phone with no server-side ownership check (OneUptime Advisory).

• Network: Repeated POST requests to /api/user-whats-app/resend-verification-code from a single authenticated user in a short time window; requests containing itemId values that do not correspond to the requesting user's own records.
• Logs: Application access logs showing high-frequency calls to the resend endpoint from a single bearer token or user session; HTTP 200 responses for resend requests where the itemId owner differs from the authenticated user.
• Behavioral: Victim users reporting unexpected WhatsApp verification code messages they did not request; unusual spikes in outbound WhatsApp message volume from the OneUptime instance.

The vendor has released a patch in OneUptime version 10.0.21, which should be applied immediately (OneUptime Release). As a temporary workaround prior to upgrading, administrators should implement rate limiting on the /api/user-whats-app/resend-verification-code endpoint and restrict access to trusted users or IP ranges where possible. The recommended long-term fix, as noted in the advisory, is to enforce ownership validation on the resend path — ensuring item.userId matches the authenticated user's ID — mirroring the check already present in the verify endpoint (Github Advisory).