An unauthenticated OIDC login endpoint allocates an unbounded number of in‑memory state entries for each request without any rate limiting or cap on concurrent live entries. This uncontrolled allocation falls under CWE‑400, leading to the possibility of exhausting system memory and causing a denial of service. The vulnerability exists in the nebula‑mesh control plane when OIDC is enabled and allows any remote client to create thousands or millions of state values that are stored for ten minutes each until lazily swept.

The affected product is nebula‑mesh from forgekeep, with vulnerability present in versions from 0.2.0 up to, but not including, 0.5.0. Version 0.5.0 and later contain the fix for this issue.

The CVSS score of 5.3 reflects a moderate severity, and no EPSS data is available, so the exploitation probability is uncertain but could be significant in environments with unconstrained network exposure. The vulnerability is not listed in CISA's KEV catalog. An attacker can trigger the exploit by sending many unauthenticated GET requests to /ui/oidc/login from a remote location; each request creates a state value that remains in memory for up to ten minutes, effectively bypassing authentication rate limits. Over time, the continuous allocation can deplete available memory, potentially crashing the service or severely degrading performance.