Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-28787

31
FAUCET Score

CVE-2026-28787 affects OneUptime versions 10.0.11 and prior, where a flaw in the WebAuthn implementation allows for replay attacks. The server fails to store the challenge, instead returning it to the client, enabling an attacker to reuse a valid WebAuthn assertion indefinitely. This vulnerability carries a high CVSS score of 8.2 due to its network attack vector, high impact on confidentiality and integrity, and low privileges required, though it has high attack complexity. There are no known patches, active exploits, or public exploit code available, but it has garnered some community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
<= 10.0.11CPE matchmatch criteria
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.2HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
1.8
Impact Score
5.8
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.28%
Probability of exploitation in next 30 days
EPSS Percentile
19.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0028 is in the 7th percentile among its peer group of 200 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.4 Reddit, 1.2 Bluesky, 0.8 Mastodon, and 2.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.8 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Advisories (1)

npmGHSA-gjjc-pcwp-c74mhigh

OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay

Mar 2, 2026

References

github.com / OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m
ExploitVendor Advisory