Enabling Authentication does not close all logged in socket connections immediately
Summary
This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.
PoC
- Open Uptime Kuma with authentication disabled
- Enable authentication using another window
- Access the platform using the previously logged-in window
- Note that access (read-write) remains despite the enabled authentication
- Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
- Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.
Impact
See GHSA-g9v2-wqcj-j99g and GHSA-88j4-pcx8-q4q
TBH this is quite a niche edge case, so I don't know if this even warrants a security report.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | uptime-kuma | < 1.23.12 | 1.23.12 |
References
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-23q2-5gf8-gjpp
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
- https://github.com/louislam/uptime-kuma/commit/7a9e2f5de69aa0bb884ead25d1dcc833bb8c6579
- https://github.com/louislam/uptime-kuma
- Weakness (CWE)
CWE-384- Platform
- npm
- Package
uptime-kuma- Disclosed
- 19.04.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-23q2-5gf8-gjpp - CC BY 4.0
Vulnerability history: uptime-kuma
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 10.2023 03.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 8
- Low 1
Disclosures per year
- 2023: 4
- 2024: 4
- 2025: 2
- 2026: 1
-
Enabling Authentication does not close all logged in socket connections immediately this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.