External risk intelligence

OneUptime Notification API Unauthenticated Access Leading to Twilio Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-34759

The vulnerability exists in API endpoints that are exposed externally via an Nginx proxy as part of a public-facing monitoring and observability platform. These endpoints are accessible over the network without authentication, placing them in a position where they are commonly reachable in internet-facing deployments.

Hackerbay Oneuptime

before 10.0.42

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability in the OneUptime monitoring platform that could allow an unauthenticated attacker to disrupt alerting services. The issue involves unprotected API endpoints that, when combined with a separate information leak, could enable an attacker to manipulate phone numbers associated with a victim's Twilio account. The vulnerability has been addressed in the latest version of OneUptime.

Unprotected APIs could disrupt alerting services.
Protects against unauthorized access to critical services.
Confirm relevance and exposure to OneUptime.

Attack Path

How an attacker could exploit the issue

An attacker could target the OneUptime monitoring platform by first leveraging a leaked project ID from a public Status Page API. This exposure, combined with unauthenticated notification API endpoints, allows an attacker to interact with the system's communication channels. By exploiting this, an attacker could potentially compromise a victim's Twilio account, enabling them to purchase phone numbers and disrupt existing alerting configurations.

No authentication required.
Reachable notification API endpoints.
Potential for account takeover.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could interact with unprotected notification API endpoints. This could potentially lead to unauthorized actions on a victim's Twilio account.

System data could be affected.
Unprotected API endpoints could be accessed.
Phone numbers could be purchased or deleted.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OneUptime platform's notification API endpoints require immediate attention from teams managing externally facing services. The first practical step involves identifying all OneUptime instances, confirming their external reachability and business criticality, and then locating the specific asset owners responsible for each instance to prioritize remediation efforts.

Platform and Security teams own this.
Verify external reachability and asset owners.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OneUptime?

OneUptime is an open-source monitoring and observability platform created by Hackerbay. It is designed to track the health of digital services and manage alerting configurations. Developers and operations teams use it to gain visibility into system performance and ensure they are notified when services experience downtime or issues.

What does CWE-862 mean for CVE-2026-34759?

CWE-862 refers to a 'Missing Authorization' weakness. In this specific vulnerability, certain notification API endpoints in OneUptime lack the security middleware required to check if a user is allowed to perform an action. Because these endpoints skip this check, an unauthenticated attacker can interact with sensitive features as if they were a legitimate, authorized user.

How can an attacker trigger this vulnerability?

An attacker needs two pieces of information to trigger the bug: access to the unauthenticated notification API endpoints and a project ID. The project ID is obtainable through a public Status Page API leak. It is important to note that internal API endpoints correctly using authorization middleware are not affected; only the specific notification endpoints exposed via the Nginx proxy are vulnerable.

Is my OneUptime instance at risk?

According to Halo Surface Signal, this vulnerability is likely to affect your system if your OneUptime instance is internet-facing. Because the vulnerable notification endpoints are reachable through the Nginx proxy, any instance exposed to the public network is a potential target for unauthorized manipulation of your Twilio alerting configuration.

How do I secure my environment against CVE-2026-34759?

The most effective way to secure your environment is to update your OneUptime installation to version 10.0.42 or later, which includes the necessary authorization patches. Before updating, identify all running instances to determine which are reachable from the internet and coordinate with the asset owners to prioritize applying the update across your infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.