The vulnerability lies in OneUptime's implementation of WebAuthn, which does not store the server‑generated challenge during the authentication dance. Instead, it echoes the challenge back to the client and validates the client’s signed response against that echoed challenge. This deviation from the WebAuthn specification allows an adversary who has captured a valid WebAuthn assertion to replay it any number of times, effectively bypassing the second‑factor protection and gaining unauthorized access. The weakness is a classic authentication bypass (CWE‑287).

Affected products are OneUptime versions 10.0.11 and earlier. The operation is limited to the OneUptime monitoring and management platform; any deployment of these versions is susceptible.

The CVSS score is 8.2, indicating a high‑severity flaw, while the EPSS score of less than 1% suggests exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. The likely attack path requires an attacker to obtain a valid WebAuthn assertion—through cross‑site scripting, man‑in‑the‑middle interception, or log exposure—and then replay that assertion to the server, which will accept it because it trusts the client‑supplied challenge. No patch is yet available, but the flaw is fully exploitable once the assertion is captured.