CVE-2026-28789

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

Published Mar 5, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.

Analysis

Technical impact

OliveTin allows execution of predetermined shell commands via a web interface. In versions prior to 3000.10.3, the OAuth2 login flow contains an unguarded concurrent write to a shared states map. Multiple simultaneous requests to the /oauth/login endpoint can trigger a Go runtime panic, terminating the process. The flaw is exploitable without authentication, allowing remote attackers to crash the service whenever OAuth2 is enabled.

Affected Systems

OliveTin software versions earlier than 3000.10.3 are affected. The vulnerability is tied to the OAuth2 authentication mechanism within the OliveTin application.

Risk and Exploitability

The CVSS score is 7.5, indicating a high impact denial‑of‑service vulnerability. EPSS is below 1 %, suggesting a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, unauthenticated HTTP requests targeting the /oauth/login endpoint. Exploitation requires the ability to send concurrent requests; no special privileges or network access are needed beyond reaching the OliveTin service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OliveTin

affected

Version	Status	Constraints
`< 3000.10.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Olivetin

Version	Status	Scheme	Platform
`[0,3000.10.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OliveTin to version 3000.10.3 or newer, where the concurrent map write bug has been fixed.
If upgrading immediately is not possible, disable OAuth2 authentication to eliminate the vulnerable endpoint.
After applying a patch or disabling OAuth2, restart the OliveTin service to ensure the updated code is running and monitor for repeated crashes.

Generated by OpenCVE AI on April 16, 2026 at 12:12 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-45m3-398w-m2m9	OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.453% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/OliveTin/OliveTin/commit/f044d90d5525c4c8e3f421b32ed7eff771c22d36
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9

History

Mar 10, 2026 3:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:olivetin:olivetin::::::::

Mar 6, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 6, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Olivetin Olivetin olivetin
Vendors & Products		Olivetin Olivetin olivetin

Mar 5, 2026 8:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.
Title		OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling
Weaknesses		CWE-362 CWE-400 CWE-662
References		https://github.com/OliveTin/OliveTin/commit/f044d90d5525c4c8e3f421b32ed7eff771c22d36 https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Subscriptions

Olivetin Olivetin

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-400
Uncontrolled Resource Consumption
CWE-662
Improper Synchronization