CVE-2023-44400

    Dashboard / Vulnerabilities / CVE-2023-44400

    CVE-2023-44400

    Published: 9 Oct 2023Last Modified: 12 Aug 2026

    Summary: Uptime Kuma has Persistentent User Sessions

    Details: Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44400.json, https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g, https://nvd.nist.gov/vuln/detail/CVE-2023-44400, https://github.com/louislam/uptime-kuma/issues/3481, https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c3e3f27457c52cf5056d0eed1c7fd5f9c12f4d91

    Affected versions

    1.23.2
    1.23.1
    1.23.0
    1.23.0-beta.1
    1.23.0-beta.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-44400 | CVE-DB