The vulnerability arises from missing authentication checks on OneUptime’s Notification test and Phone Number management endpoints. An attacker who can send unauthenticated requests to these endpoints can trigger SMS, call, email, or WhatsApp messages and even purchase phone numbers. The lack of credential verification allows an external actor to abuse the platform’s communication capabilities, potentially spamming users, violating regulatory requirements, or incurring unexpected costs. This weakness is cataloged under CWE‑306, indicating an authentication bypass.

The flaw affects the OneUptime open‑source monitoring and observability platform, specifically all releases prior to version 10.0.42. Users running 10.0.41 or earlier versions are vulnerable. Corporate deployments of OneUptime that expose the notification endpoints to external networks are at risk. Version 10.0.42 and newer contain the fix where authentication is enforced on the affected endpoints.

With a CVSS score of 9.1 the vulnerability is classified as critical. No EPSS score is available, but the absence of authentication suggests that exploitation requires only the discovery of the endpoints, which are exposed by default. The issue has not been listed in the CISA KEV catalog, yet the potential for large‑scale abuse makes it a high‑priority target. Consequently, the risk remains high until the platform is updated or network controls are applied.