OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the…

OneUptime monitoring solution version 10.0.11 and prior contains a critical WebAuthn authentication implementation flaw. The system does not store authentication challenges server-side, instead returning them to the client and accepting them back during verification. This violates W3C WebAuthn specifications and allows attackers who obtain valid WebAuthn assertions through XSS, MitM, or log exposure to replay them indefinitely. The vulnerability completely bypasses second-factor authentication with no known patches available.