Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-30959 is an authorization bypass vulnerability in OneUptime's WhatsApp resend-verification-code API endpoint. It allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by specifying its ID without validating ownership. Unlike the verify endpoint, which checks if the UserWhatsApp record belongs to the authenticated user, the resend-verification-code endpoint lacks this authorization check."}, {'type': 'paragraph', 'content': "This means an attacker with a valid account and knowledge of another user's UserWhatsApp item ID can cause verification codes to be sent repeatedly to that user's phone number."}] [2]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can be exploited to spam or perform denial-of-service attacks on victims' phone numbers by repeatedly triggering verification code resends. This can lead to social engineering pressure on the victim or cause account lockouts due to excessive verification attempts."}] [2]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves the resend-verification-code endpoint allowing any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID without ownership validation.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your system or network, you can monitor POST requests to the /api/user-whats-app/resend-verification-code endpoint, especially those that include itemIds not belonging to the authenticated user.'}, {'type': 'paragraph', 'content': 'Suggested commands include inspecting web server or application logs for suspicious POST requests to this endpoint. For example, using grep on log files:'}, {'type': 'list_item', 'content': 'grep "/api/user-whats-app/resend-verification-code" /var/log/nginx/access.log'}, {'type': 'list_item', 'content': 'grep POST /path/to/application/logs | grep resend-verification-code'}, {'type': 'paragraph', 'content': 'Additionally, you can look for repeated resend attempts from the same or different authenticated users targeting different itemIds, which may indicate abuse.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include updating OneUptime to version 10.0.21 or later, where this vulnerability has been patched.'}, {'type': 'paragraph', 'content': "The patch enforces ownership verification by ensuring that the UserWhatsApp item's userId matches the authenticated user's ID before allowing a resend of the verification code."}, {'type': 'paragraph', 'content': 'Additionally, implementing per-item and per-user rate limiting on resend attempts can help prevent abuse such as spamming or denial-of-service attacks.'}, {'type': 'paragraph', 'content': 'If immediate upgrade is not possible, consider monitoring and restricting access to the resend-verification-code endpoint and auditing authenticated user actions related to this endpoint.'}] [2, 1]

Useful 0 Not Useful 0