CVE-2026-119552
Medium · 4.8CVSS
4.8
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-367
- CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-367
- CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate… CWE-367
- CVE-2026-92374 A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link… CWE-367
- CVE-2026-117603 Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet… CWE-367
- CVE-2026-75524 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-367
- CVE-2026-105481 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a… CWE-367
- CVE-2026-57114 PraisonAI is a multi-agent teams system. CWE-367