OliveTin, a web interface for predefined shell commands, contains an unauthenticated denial-of-service vulnerability in its OAuth2 login flow prior to version 3000.10.3. The vulnerability allows remote attackers to crash the service by sending concurrent requests to /oauth/login, which triggers unsynchronized access to a shared registeredStates map in Go, causing a runtime panic and process termination. This affects installations where OAuth2 authentication is enabled. The issue has been patched in version 3000.10.3.