This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-119552 | BDVDB-2026-398513 Detail

louislamuptime-kuma

Description#

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.