Vulnerability in github.com/OliveTin/OliveTin (CVE-2026-67437)
Summary
Vulnerability in github.com/OliveTin/OliveTin (CVE-2026-67437). Risk of unauthorized operations or information disclosure. Exploitable via registeredStates. Mitigation: upgrade to 0.0.0-20260708075951-ec114e95d297 or later.
Original description
The description as published by the source.
Summary
OliveTin's OAuth2 login handler stores per-login state in an in-memory map (registeredStates) that grows unboundedly. States are added on every /oauth/login request but are never deleted or expired. An unauthenticated attacker can send millions of requests to /oauth/login to fill the map with state entries, exhausting server memory and causing a denial of service.
This is distinct from CVE-2026-28789 (concurrent map writes crash). That CVE was about the panic from unsynchronized map access — the fix added a sync.RWMutex. This vulnerability is about the unbounded growth of the map even WITH the mutex, as no cleanup mechanism exists.
Affected Versions
- All versions with OAuth2 support, including >= 3000.10.3 (which patched CVE-2026-28789)
Details
In service/internal/auth/otoauth2/restapi_auth_oauth2.go:
type OAuth2Handler struct {
cfg *config.Config
mu sync.RWMutex
registeredStates map[string]*oauth2State // NEVER cleaned up
registeredProviders map[string]*oauth2.Config
}
The HandleOAuthLogin handler adds a new state on every request:
func (h *OAuth2Handler) HandleOAuthLogin(w http.ResponseWriter, r *http.Request) {
state, _ := randString(16) // 24-byte base64 string
// ...
h.mu.Lock()
h.registeredStates[state] = &oauth2State{
providerConfig: provider,
providerName: providerName,
Username: "",
}
h.mu.Unl…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-67437 has been found in github.com/OliveTin/OliveTin.
Attackers can target a specific entry point like registeredStates over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade github.com/OliveTin/OliveTin to 0.0.0-20260708075951-ec114e95d297 or later.
If unsure, ask your IT team or search "github.com/OliveTin/OliveTin CVE-2026-67437" on the vendor's site.
CVE-2026-67437 (github.com/OliveTin/OliveTin) — CWE-400 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: registeredStates / sync.RWMutex / HandleOAuthLogin / HandleOAuthCallback
Patched: 0.0.0-20260708075951-ec114e95d297 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-400) exists in github.com/OliveTin/OliveTin. Attackers reach the vulnerable code path via registeredStates without authentication.
Check the vendor advisory for the affected versions of github.com/OliveTin/OliveTin. Attack surface: registeredStates / sync.RWMutex / HandleOAuthLogin / HandleOAuthCallback.
Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.
Update to 0.0.0-20260708075951-ec114e95d297.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/OliveTin/OliveTin' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/OliveTin/OliveTin' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/OliveTin/OliveTinを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade github.com/OliveTin/OliveTin to 0.0.0-20260708075951-ec114e95d297ステージング環境で 0.0.0-20260708075951-ec114e95d297 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com