CVE-2026-30959 — OneUptime has WhatsApp Resend Verification Authorization Bypass
OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend fo…
Published: 2026-03-10 · CVSS: 5.3 · CVSS 4.0
OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7