A race condition in the OliveTin OAuth2 login flow allows unauthenticated remote attackers to trigger a service crash and denial-of-service state.

This vulnerability is a race condition (CWE-362) resulting from improper synchronization during the OAuth2 login process. An unauthenticated attacker can send concurrent requests to the /oauth/login endpoint, causing a Go runtime panic due to unsynchronized access to a shared map object, which subsequently terminates the application process.

Successful exploitation of this vulnerability results in a complete denial-of-service for the OliveTin web interface. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to operational continuity, as attackers can repeatedly crash the service to prevent authorized users from accessing predefined shell commands.

Immediate Action: Update OliveTin to version 3000.10.3 or later to apply the necessary synchronization fixes for the OAuth2 login flow.

Proactive Monitoring: Review web server access logs for abnormally high volumes of requests directed at the /oauth/login endpoint, which may indicate attempted exploitation.

Compensating Controls: If immediate patching is not feasible, disable OAuth2 authentication if an alternative authentication method is available, or restrict access to the web interface via network-level controls such as a VPN or IP allowlisting.

Public Exploit Available: Unknown

The risk of service disruption is substantial, especially given the ease with which an unauthenticated attacker can trigger a process crash. Administrators must prioritize updating to the patched version as soon as possible to ensure service stability and prevent potential abuse of this vulnerability.