GoRest is a Golang starter kit that provides RESTful API scaffolding. In versions before 1.12.2, the InMemorySecret2FA component uses an unsynchronized package‑level map to store two‑factor authentication secrets. Concurrent read and write access to this map by HTTP handlers triggers a fatal error in the Go runtime, resulting in a crash of the entire process. The impact is a repeatable denial of service that affects only availability; there is no direct loss of confidentiality or integrity.

The affected product is pilinux’s GoRest, a Golang web framework toolkit. The vulnerability exists in all releases prior to 1.12.2. Deployments that enable the two‑factor authentication flow through the login or twoFA routes are directly impacted.

The CVSS score of 5.9 indicates medium severity, and the EPSS score is not available, suggesting limited data on exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the race condition by repeatedly invoking the affected endpoints with concurrent requests, a path that is trivial to execute from any machine with network access to the API, without requiring advanced privileges or payload delivery.