GHSA-23q2-5gf8-gjpp
Enabling Authentication does not close all logged in socket connections immediately
Summary
This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.
PoC
- Open Uptime Kuma with authentication disabled
- Enable authentication using another window
- Access the platform using the previously logged-in window
- Note that access (read-write) remains despite the enabled authentication
- Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
- Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.
Impact
See GHSA-g9v2-wqcj-j99g and GHSA-88j4-pcx8-q4q
TBH this is quite a niche edge case, so I don't know if this even warrants a security report.
What each source reports
GitHub AdvisoriesNo score
Enabling Authentication does not close all logged in socket connections immediately
Summary
This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.
PoC
- Open Uptime Kuma with authentication disabled
- Enable authentication using another window
- Access the platform using the previously logged-in window
- Note that access (read-write) remains despite the enabled authentication
- Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
- Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.
Impact
See GHSA-g9v2-wqcj-j99g and GHSA-88j4-pcx8-q4q
TBH this is quite a niche edge case, so I don't know if this even warrants a security report.
- Record
GHSA-23q2-5gf8-gjpp- Weakness
- CWE-384
- Updated
- 2026-11-02
OSVNo score
Enabling Authentication does not close all logged in socket connections immediately
Summary
This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.
PoC
- Open Uptime Kuma with authentication disabled
- Enable authentication using another window
- Access the platform using the previously logged-in window
- Note that access (read-write) remains despite the enabled authentication
- Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
- Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.
Impact
See GHSA-g9v2-wqcj-j99g and GHSA-88j4-pcx8-q4q
TBH this is quite a niche edge case, so I don't know if this even warrants a security report.
- Record
GHSA-23q2-5gf8-gjpp- Weakness
- CWE-384
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uptime-kumanpm | through 1.23.11 | 1.23.12 |
uptime-kumanpm | before 1.23.12 | 1.23.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-23q2-5gf8-gjpp is a vulnerability with no CVSS score yet in uptime-kuma, published April 19, 2024. No source lists public exploit code. Fixed in uptime-kuma 1.23.12.
References
github.com/louislam/uptime-kuma/security/advisories/GHSA-23q2-5gf8-gjpp