GHSA-45m3-398w-m2m9 CVE-2026-28789 GO-2026-4586
OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.45%
- Chance of exploitation in the next 30 days. Higher than 39.35% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-400 Uncontrolled Resource Consumption
- CWE-662 Improper Synchronization
- Fix
0.0.0-20260301235225-f044d90d5525c- Upgrade github.com/OliveTin/OliveTin to this version or later
Description
Summary
An unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled.
Details
The OAuth2 handler stores per-login state in a shared map without synchronization:
- service/internal/auth/otoauth2/restapi_auth_oauth2.go:24 registeredStates map[string]*oauth2State
- Unlocked write in login handler: .../restapi_auth_oauth2.go:141
- Unlocked read in callback check: .../restapi_auth_oauth2.go:174
- Unlocked writes in callback flow: .../restapi_auth_oauth2.go:284-285
- Unlocked read in auth chain check: .../restapi_auth_oauth2.go:376
These paths are network reachable via publicly registered routes:
- service/internal/httpservers/frontend.go:71 → /oauth/login
- service/internal/httpservers/frontend.go:72 → /oauth/callback
Because Go HTTP handlers run concurrently, high parallel traffic to /oauth/login causes concurrent map access and runtime panic.
Tested on:
- Container image: ghcr.io/olivetin/olivetin:3000.10.0
- Source also contains same pattern at commit/tag eb42029b5d0c0633551621288180dd4566b913f7 (3000.10.1)
PoC
- Start OliveTin with OAuth2 provider configured (example github), exposing port 1337.
- Confirm baseline:
curl -i http://127.0.0.1:1337/readyz
curl -i "http://127.0.0.1:1337/oauth/login?provider=github"
Expected: 200 for /readyz, 302 for /oauth/login.
- Run concurrency PoC:
python3 /OliveTin/tools/poc_oauth2_state_map_race_dos.py \
--base-url http://127.0.0.1:1337 \
--provider github \
--workers 80 \
--requests 120000 \
--health-failures 3
- Verify crash:
docker inspect olivetin-dos --format 'status={{.State.Status}} exit={{.State.ExitCode}}' docker logs olivetin-dos 2>&1 | grep -E "fatal error: concurrent map|concurrent map writes|restapi_auth_oauth2.go"
Observed result:
- Process exited with code 2
- Logs include:
- fatal error: concurrent map writes
- .../internal/auth/otoauth2/restapi_auth_oauth2.go:141 in HandleOAuthLogin
Impact
- Vulnerability type: Race condition (CWE-362) leading to DoS.
- Attacker requirements: network access only; no authentication required for exploit path.
- Impacted deployments: OliveTin instances with OAuth2 enabled and reachable over network.
- Security impact: remote unauthenticated attacker can repeatedly crash OliveTin, causing availability loss until restart/recovery.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/OliveTin/OliveTin | < 0.0.0-20260301235225-f044d90d5525c |
0.0.0-20260301235225-f044d90d5525c |
| github.com/OliveTin/OliveTin | all versions |
No fix yet |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/OliveTin/OliveTin Go → 0.0.0-20260301235225-f044d90d5525c
- go
go get github.com/OliveTin/OliveTin@v0.0.0-20260301235225-f044d90d5525c && go mod tidy
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How to prevent it
- Architecture and Design: In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
- Architecture and Design: Use thread-safe capabilities such as the data access abstraction in Spring.
- Architecture and Design: Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
- Implementation: When using multithreading and operating on shared variables, only use thread-safe functions.
- Implementation: Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
- Implementation: Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
- Implementation: Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
- Implementation: Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
- Implementation: Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How to prevent it
- Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
- Implementation: Ensure that all failures in resource allocation place the system into a safe posture.
CWE-662: Improper Synchronization
The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
How to prevent it
- Implementation: Use industry standard APIs to synchronize your code.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jm28-2wcr-qf3h OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output | Medium | Also affects github.com/OliveTin/OliveTin |
| GHSA-xc5w-4v5w-7x65 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check | Medium | Also affects github.com/OliveTin/OliveTin |
| GHSA-xpxj-f2fm-rqch OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) | High | Also affects github.com/OliveTin/OliveTin |
| GHSA-prj9-97mp-mwh2 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering | Medium | Also affects github.com/OliveTin/OliveTin |
| GHSA-f637-w7p2-m7fx OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration | Low | Also affects github.com/OliveTin/OliveTin |
| GHSA-7fq5-7wr8-rjwj OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination | High | Also affects github.com/OliveTin/OliveTin |
| GHSA-xx6g-43w2-9g6g OliveTin's email argument makes compliance harder, enables log injection | Medium | Also affects github.com/OliveTin/OliveTin |
| GHSA-228v-wc5r-j8m7 OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream | Medium | Also affects github.com/OliveTin/OliveTin |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor