A NULL pointer dereference occurs in the sendOTPEmail function of the fastschema authentication module, which is called during the account recovery flow. When an unauthenticated attacker sends a recovery request to the /api/auth/local/recover endpoint, the function dereferences a pointer that may be nil due to an unchecked error path, causing a fatal panic that terminates the server process. This results in a denial of service, rendering the application unavailable until the service is restarted, and can be triggered with a single HTTP request.

The vulnerability affects the fastschema software produced by fastschema:fastschema. All installations of fastschema up to and including version 0.15.1 are vulnerable; later releases that patch the issue are not affected. No other products or versions are listed as impacted in the current data.

The CVSS score of 7.5 indicates a high severity attack surface. The EPSS score is not available, so the current probability of exploitation cannot be quantified. The vulnerability is not currently listed in CISA’s KEV catalog, suggesting that no known real‑world exploits have been reported. The attack vector is an unauthenticated remote attacker able to send an HTTP request to the public endpoint. If exploited, the impact is a complete crash of the fastschema server process, leading to a denial of service for all users until the process is manually restarted or automatically recovered by a supervising process.