CVE-2026-28789 is a high-severity (CVSS 7.5) CWE-362 vulnerability in github.com/OliveTin/OliveTin. A fix is available for github.com/OliveTin/OliveTin — see the affected versions and patch details below.
OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-28789.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
github.com/OliveTin/OliveTinReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
An unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled.
Details
The OAuth2 handler stores per-login state in a shared map without synchronization:
- service/internal/auth/otoauth2/restapi_auth_oauth2.go:24 registeredStates map[string]*oauth2State
- Unlocked write in login handler: .../restapi_auth_oauth2.go:141
- Unlocked read in callback check: .../restapi_auth_oauth2.go:174
- Unlocked writes in callback flow: .../restapi_auth_oauth2.go:284-285
- Unlocked read in auth chain check: .../restapi_auth_oauth2.go:376
These paths are network reachable via publicly registered routes:
- service/internal/httpservers/frontend.go:71 → /oauth/login
- service/internal/httpservers/frontend.go:72 → /oauth/callback
Because Go HTTP handlers run concurrently, high parallel traffic to /oauth/login causes concurrent map access and runtime panic.
Tested on:
- Container image: ghcr.io/olivetin/olivetin:3000.10.0
- Source also contains same pattern at commit/tag eb42029b5d0c0633551621288180dd4566b913f7 (3000.10.1)
PoC
- Start OliveTin with OAuth2 provider configured (example github), exposing port 1337.
- Confirm baseline:
curl -i http://127.0.0.1:1337/readyz
curl -i "http://127.0.0.1:1337/oauth/login?provider=github"
Expected: 200 for /readyz, 302 for /oauth/login.
- Run concurrency PoC:
python3 /OliveTin/tools/poc_oauth2_state_map_race_dos.py \
--base-url http://127.0.0.1:1337 \
--provider github \
--workers 80 \
--requests 120000 \
--health-failures 3
- Verify crash:
docker inspect olivetin-dos --format 'status={{.State.Status}} exit={{.State.ExitCode}}' docker logs olivetin-dos 2>&1 | grep -E "fatal error: concurrent map|concurrent map writes|restapi_auth_oauth2.go"
Observed result:
- Process exited with code 2
- Logs include:
- fatal error: concurrent map writes
- .../internal/auth/otoauth2/restapi_auth_oauth2.go:141 in HandleOAuthLogin
Impact
- Vulnerability type: Race condition (CWE-362) leading to DoS.
- Attacker requirements: network access only; no authentication required for exploit path.
- Impacted deployments: OliveTin instances with OAuth2 enabled and reachable over network.
- Security impact: remote unauthenticated attacker can repeatedly crash OliveTin, causing availability loss until restart/recovery.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/OliveTin/OliveTin | all versions | 0.0.0-20260301235225-f044d90d5525cgo get github.com/OliveTin/OliveTin@v0.0.0-20260301235225-f044d90d5525c |
Affected Products
olivetinolivetinDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/OliveTin/OliveTin, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/OliveTin/OliveTin to 0.0.0-20260301235225-f044d90d5525c or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-28789 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is CVE-2026-28789 in your dependencies?
Find it across Go, including transitive dependencies.