CVE-2026-119552

EUVD-2026-113817
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
TOCTOU
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/uptime-kuma-setup-toctou
https://github.com/louislam/uptime-kuma
https://github.com/louislam/uptime-kuma/blob/2.5.8/server/server.js#L705-L722
https://www.vulncheck.com/advisories/uptime-kuma-through-2.5.8-race-condition-admin-creation-via-setup-handler