Uptime Kuma through version 2.5.8 has a race condition in its Socket.IO first‑run setup handler. An unauthenticated attacker can send simultaneous setup requests while a bcrypt hash is in progress, bypassing the check that no users exist. This allows the attacker to create an additional administrator account. Once an admin account exists, the attacker gains full control over the instance, including the ability to modify monitors, API keys, and to enable or disable authentication.

The flaw affects installations of the Uptime Kuma project provided by louislam, specifically all releases up to and including 2.5.8. Any deployment that has not upgraded beyond that version and has not yet established an initial administrator account is potentially vulnerable.

The CVSS score of 6.3 indicates medium severity, and no EPSS score is publicly available, so the likelihood of exploitation remains unknown. The vulnerability is currently not listed in the CISA KEV catalog. Attackers with network access to the setup endpoint can exploit the race condition while the service’s user table is empty, allowing privileged access by creating a new admin account.