OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.g…

A denial-of-service vulnerability exists in OliveTin versions 3000.0.0 through 3000.17.0. The OAuth2 login handler in restapi_auth_oauth2.go stores per-login state entries in the registeredStates map on every /oauth/login request without any expiration, deletion, or size bounding. An unauthenticated attacker can repeatedly send requests to this endpoint, causing unbounded memory growth and ultimately exhausting system memory. This results in a denial of service condition. No authentication is required to exploit this vulnerability. The issue has been patched in version 3000.17.0. Users are advised to upgrade immediately to mitigate the risk.