CVE-2026-71862

Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

Published Aug 21, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.

Analysis

Technical impact

The vulnerability arises when the global showURL setting is enabled, allowing an unauthenticated GET request to /api/v1/status-page/:url to return the full monitor object in JSON, including the secret field used as an HTTP Authorization credential. Attackers can read the bearer token from the response and use it to authenticate against monitored services, constituting a confidentiality breach and credential exposure.

Affected Systems

The affected product is Checkmate by bluewave‑labs. Versions from 3.3.0 up to but excluding 3.9.2 are impacted. The flaw is resolved in Checkmate 3.9.2 and later releases.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw by accessing the public or internal /api/v1/status-page/:url endpoint without authentication; the exposed bearer token provides full access to monitored services.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

bluewave-labs

Checkmate

affected

Version	Status	Constraints
`>= 3.3.0, < 3.9.2`	affected	—

No data.

Vendor Product Versions

Bluewave-labs

Checkmate

Version	Status	Scheme	Platform
`[3.3.0,3.9.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Checkmate to v3.9.2 or later.
Disable the global showURL setting to prevent unauthenticated status-page exposure.
Implement authentication or rate limiting on the /api/v1/status-page/:url endpoint to restrict access.

Generated by OpenCVE AI on August 21, 2026 at 19:56 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.482% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/bluewave-labs/Checkmate/commit/cc1814f507041bb0f64845bed5d5442c21e920f2
https://github.com/bluewave-labs/Checkmate/pull/3758
https://github.com/bluewave-labs/Checkmate/releases/tag/v3.9.2
https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-3m74-8cg9-rp8j

History

Aug 21, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 21, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Bluewave-labs Bluewave-labs checkmate
Vendors & Products		Bluewave-labs Bluewave-labs checkmate

Aug 21, 2026 6:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.
Title		Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled
Weaknesses		CWE-200 CWE-522
References		https://github.com/bluewave-labs/Checkmate/commit/cc1814f507041bb0f64845bed5d5442c21e920f2 https://github.com/bluewave-labs/Checkmate/pull/3758 https://github.com/bluewave-labs/Checkmate/releases/tag/v3.9.2 https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-3m74-8cg9-rp8j
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`