OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.

Affected: Go: github.com/OliveTin/OliveTin

### Summary An unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled.

### Details The OAuth2 handler stores per-login state in a shared map without synchronization:

- service/internal/auth/otoauth2/restapi_auth_oauth2.go:24 registeredStates map[string]*oauth2State - Unlocked write in login handler: .../restapi_auth_oauth2.go:141 - Unlocked read in callback check: .../restapi_auth_oauth2.go:174 - Unlocked writes in callback flow: .../restapi_auth_oauth2.go:284-285 - Unlocked read in auth chain check: .../restapi_auth_oauth2.go:376

These paths are network reachable via publicly registered routes: ```bash - service/internal/httpservers/frontend.go:71 → /oauth/login - service/internal/httpservers/frontend.go:72 → /oauth/callback ``` Because Go HTTP handlers run concurrently, high parallel traffic to /oauth/login causes concurrent map access and runtime panic.

Tested on:

- Container image: ghcr.io/olivetin/olivetin:3000.10.0 - Source also contains same pattern at commit/tag eb42029b5d0c0633551621288180dd4566b913f7 (3000.10.1)

### PoC 1. Start OliveTin with OAuth2 provider configured (example github), exposing port 1337. 2. Confirm baseline: ```ba…