CVEvulnerability

CVE-2026-28789

7.5 HIGH Published 2026-03-05 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-362, CWE-400, CWE-662

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.

Affected configurations

• olivetin olivetin (<= 3000.10.2)

Related

Weakness · CWE (3)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-662 Improper Synchronization weakness

References