EUVD-2026-275309

fkie_cve-2026-30959

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

GHSA-cw6x-mw64-q6pv — OneUptime has WhatsApp Resend Verification Authorization Bypass

Affected: npm: @oneuptime/common

### Description The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any `UserWhatsApp` record by ID. Ownership is not validated (unlike the verify endpoint).

### Affected Source - Endpoint: [UserWhatsAppAPI.ts](https://github.com/OneUptime/oneuptime/Common/Server/API/UserWhatsAppAPI.ts#L129-L153) - Service: [UserWhatsAppService.ts](https://github.com/OneUptime/oneuptime/Common/Server/API/UserWhatsAppAPI.ts#L129-L153) - Verify ownership (present in verify endpoint for comparison): [UserWhatsAppAPI.ts](https://github.com/OneUptime/oneuptime/Common/Server/API/UserWhatsAppAPI.ts#L78-L87)

### Full Code Lines (UserWhatsAppAPI.ts)

Resend path (authorization gap):

```ts this.router.post( `${new this.entityType() .getCrudApiPath() ?.toString()}/resend-verification-code`, UserMiddleware.getUserMiddleware, async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => { try { req = req as OneUptimeRequest;

if (!req.body.itemId) { return Response.sendErrorResponse( req, res, new BadDataException("Invalid item ID"), ); }

await this.service.resendVerificationCode(req.body.itemId);

return Response.sendEmptySuccessResponse(req, res); } catch (err) { return next(err); } }, ); ```

Verify path (ownership check pre…

Most recent entries from all

EUVD-2026-275309

fkie_cve-2026-30959

GHSA-cw6x-mw64-q6pv — OneUptime has WhatsApp Resend Verification Authorization Bypass