OliveTin allows execution of predetermined shell commands via a web interface. In versions prior to 3000.10.3, the OAuth2 login flow contains an unguarded concurrent write to a shared states map. Multiple simultaneous requests to the /oauth/login endpoint can trigger a Go runtime panic, terminating the process. The flaw is exploitable without authentication, allowing remote attackers to crash the service whenever OAuth2 is enabled.

OliveTin software versions earlier than 3000.10.3 are affected. The vulnerability is tied to the OAuth2 authentication mechanism within the OliveTin application.

The CVSS score is 7.5, indicating a high impact denial‑of‑service vulnerability. EPSS is below 1 %, suggesting a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, unauthenticated HTTP requests targeting the /oauth/login endpoint. Exploitation requires the ability to send concurrent requests; no special privileges or network access are needed beyond reaching the OliveTin service.