Is CVE-2026-34840 actively exploited?

No active exploitation of CVE-2026-34840 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34840 be exploited remotely?

Yes. CVE-2026-34840 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34840?

CVE-2026-34840 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-34840

HIGH

CVE-2026-34840

CWE-347Published: April 2, 2026· Updated: Apr 3, 2026

8.1

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.2th

Official Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils/SSO.ts) has decoupled signature verification and identity extraction. isSignatureValid() verifies the first <Signature> element in the XML DOM using xml-crypto, while getEmail() always reads from assertion[0] via xml2js. An attacker can prepend an unsigned assertion containing an arbitrary identity before a legitimately signed assertion, resulting in authentication bypass. This issue has been patched in version 10.0.42.

NVD Source

Technical Analysis

CVE-2026-34840 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.