{"id":"GHSA-23q2-5gf8-gjpp","aliases":[],"status":"published","title":"Enabling Authentication does not close all logged in socket connections immediately","description":"### Summary\nThis is basically [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3) but instead of changing passwords, when enabling authentication.\n\n### PoC\n- Open Uptime Kuma with authentication disabled\n- Enable authentication using another window\n- Access the platform using the previously logged-in window\n- Note that access (read-write) remains despite the enabled authentication\n- Expected behaviour:\n  - After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.\n- Actual behaviour:\n  - The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.\n\n### Impact\nSee [GHSA-g9v2-wqcj-j99g](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g) and [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3)\n\nTBH this is quite a niche edge case, so I don't know if this even warrants a security report.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-384"],"published":"2024-04-19T17:26:32Z","modified":"2024-04-19T17:26:37Z","fixes":[{"ecosystem":"npm","package":"uptime-kuma","fixed_in":["1.23.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"uptime-kuma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.23.11"},{"fixed":"1.23.12"}]}]},{"source":"osv","ecosystem":"npm","package":"uptime-kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.12"}]}]}],"references":[{"url":"https://github.com/louislam/uptime-kuma/security/advisories/GHSA-23q2-5gf8-gjpp","tags":["web"]},{"url":"https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3","tags":["web"]},{"url":"https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g","tags":["web"]},{"url":"https://github.com/louislam/uptime-kuma/commit/7a9e2f5de69aa0bb884ead25d1dcc833bb8c6579","tags":["web"]},{"url":"https://github.com/advisories/GHSA-23q2-5gf8-gjpp"},{"url":"https://github.com/louislam/uptime-kuma","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-23q2-5gf8-gjpp","title":"Enabling Authentication does not close all logged in socket connections immediately ","description":"### Summary\nThis is basically [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3) but instead of changing passwords, when enabling authentication.\n\n### PoC\n- Open Uptime Kuma with authentication disabled\n- Enable authentication using another window\n- Access the platform using the previously logged-in window\n- Note that access (read-write) remains despite the enabled authentication\n- Expected behaviour:\n  - After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.\n- Actual behaviour:\n  - The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.\n\n### Impact\nSee [GHSA-g9v2-wqcj-j99g](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g) and [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3)\n\nTBH this is quite a niche edge case, so I don't know if this even warrants a security report.  \n","status":"published","published":"2024-04-19T17:26:32Z","modified":"2024-04-19T17:26:37Z","cwes":["CWE-384"],"updated_at":"2026-11-02T14:37:43.62603Z"}],"osv":[{"id":"GHSA-23q2-5gf8-gjpp","title":"Enabling Authentication does not close all logged in socket connections immediately ","description":"### Summary\nThis is basically [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3) but instead of changing passwords, when enabling authentication.\n\n### PoC\n- Open Uptime Kuma with authentication disabled\n- Enable authentication using another window\n- Access the platform using the previously logged-in window\n- Note that access (read-write) remains despite the enabled authentication\n- Expected behaviour:\n  - After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.\n- Actual behaviour:\n  - The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.\n\n### Impact\nSee [GHSA-g9v2-wqcj-j99g](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g) and [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3)\n\nTBH this is quite a niche edge case, so I don't know if this even warrants a security report.  \n","status":"published","published":"2024-04-19T17:26:32Z","modified":"2024-04-19T17:26:32Z","cwes":["CWE-384"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}