OneUptime’s SAML SSO implementation separates signature verification from identity extraction. The code verifies only the first <Signature> element in the XML, while the user’s email is always taken from the first assertion. An attacker can prepend an unsigned assertion containing any chosen identity before a properly signed assertion. The signature check passes on the signed part, but the application still uses the unsigned preceding assertion to determine the authenticated user, allowing login as an arbitrary user without credentials.

All releases of OneUptime prior to version 10.0.42 are affected. The issue is resolved in the 10.0.42 release and later, with no other vendors or products listed as impacted.

The CVSS score of 8.1 indicates high severity. The EPSS score is under 1%, suggesting a lower likelihood of observed exploitation at present. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit this flaw by sending a crafted SAML assertion to the SSO endpoint; any user with the injected identity could gain full application access, potentially leading to data exposure or configuration changes. Exploitation requires only the ability to create and transmit a valid SAML assertion to the target system.