GHSA-45m3-398w-m2m9 is a high-severity (CVSS 7.5) CWE-362 vulnerability in github.com/OliveTin/OliveTin. A fix is available for github.com/OliveTin/OliveTin — see the affected versions and patch details below.
OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for GHSA-45m3-398w-m2m9.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-45m3-398w-m2m9 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 378,156 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
github.com/OliveTin/OliveTinReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
An unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled.
Details
The OAuth2 handler stores per-login state in a shared map without synchronization:
- service/internal/auth/otoauth2/restapi_auth_oauth2.go:24 registeredStates map[string]*oauth2State
- Unlocked write in login handler: .../restapi_auth_oauth2.go:141
- Unlocked read in callback check: .../restapi_auth_oauth2.go:174
- Unlocked writes in callback flow: .../restapi_auth_oauth2.go:284-285
- Unlocked read in auth chain check: .../restapi_auth_oauth2.go:376
These paths are network reachable via publicly registered routes:
- service/internal/httpservers/frontend.go:71 → /oauth/login
- service/internal/httpservers/frontend.go:72 → /oauth/callback
Because Go HTTP handlers run concurrently, high parallel traffic to /oauth/login causes concurrent map access and runtime panic.
Tested on:
- Container image: ghcr.io/olivetin/olivetin:3000.10.0
- Source also contains same pattern at commit/tag eb42029b5d0c0633551621288180dd4566b913f7 (3000.10.1)
PoC
- Start OliveTin with OAuth2 provider configured (example github), exposing port 1337.
- Confirm baseline:
curl -i http://127.0.0.1:1337/readyz
curl -i "http://127.0.0.1:1337/oauth/login?provider=github"
Expected: 200 for /readyz, 302 for /oauth/login.
- Run concurrency PoC:
python3 /OliveTin/tools/poc_oauth2_state_map_race_dos.py \
--base-url http://127.0.0.1:1337 \
--provider github \
--workers 80 \
--requests 120000 \
--health-failures 3
- Verify crash:
docker inspect olivetin-dos --format 'status={{.State.Status}} exit={{.State.ExitCode}}' docker logs olivetin-dos 2>&1 | grep -E "fatal error: concurrent map|concurrent map writes|restapi_auth_oauth2.go"
Observed result:
- Process exited with code 2
- Logs include:
- fatal error: concurrent map writes
- .../internal/auth/otoauth2/restapi_auth_oauth2.go:141 in HandleOAuthLogin
Impact
- Vulnerability type: Race condition (CWE-362) leading to DoS.
- Attacker requirements: network access only; no authentication required for exploit path.
- Impacted deployments: OliveTin instances with OAuth2 enabled and reachable over network.
- Security impact: remote unauthenticated attacker can repeatedly crash OliveTin, causing availability loss until restart/recovery.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/OliveTin/OliveTin | all versions | 0.0.0-20260301235225-f044d90d5525cgo get github.com/OliveTin/OliveTin@v0.0.0-20260301235225-f044d90d5525c |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/OliveTin/OliveTin, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/OliveTin/OliveTin to 0.0.0-20260301235225-f044d90d5525c or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-45m3-398w-m2m9 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-45m3-398w-m2m9 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-45m3-398w-m2m9. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-45m3-398w-m2m9 in your dependencies?
O3 Security finds GHSA-45m3-398w-m2m9 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.