CVE-2023-44400: Uptime.kuma Uptime Kuma

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.

Affected products

• Uptime.kuma Uptime Kuma: before 1.23.3 (fixed in 1.23.3)

Published 2023-10-09. Last modified 2026-06-17.