CVE-2026-28789: OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

Vulnerability summary

CVE-2026-28789 is a high (CVSS 7.5) vulnerability in olivetin. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-03-2026
   PublishedVulnerability first disclosed.
2. 06-03-2026
   Last modifiedVulnerability information updated.

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.

• CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.