Threats tagged 'ghsa-hpf4-7mjx-jmh4'

Uptime Kuma versions through 2.5.8 have a race condition vulnerability in the Socket.IO first-run setup handler. This flaw allows unauthenticated attackers to create an additional administrator account by sending concurrent setup requests during the bcrypt hashing process. Exploitation enables attackers to bypass the empty user table check and subsequently modify monitors, API keys, and toggle authentication settings.