UpHeron
All vulnerabilities

Servers and applications

CVE-2023-49804

Changing Password does not close all logged in socket connections immediately

Severity
High 7.8
Published
10 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.3.3, 1.23.9
Also known as
GHSA-88j4-pcx8-q4q3
Sources
NVD, Project advisories (GitHub)

Description

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive…

Affected software

SoftwareAffected versions
Uptime KumaServers and applications · cpe:a:uptime.kuma:uptime_kuma
  • Every version before 1.23.9
Uptime KumaServers and applications · github:louislam/uptime-kuma
  • Every version before 1.23.9
  • Every version before 1.3.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-49804
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-49804
  • GitHub Advisory Database https://github.com/advisories/GHSA-88j4-pcx8-q4q3
  • github.com https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3