CVE-2026-28789

CVE-2026-28789 is an unauthenticated denial-of-service vulnerability affecting OliveTin versions prior to 3000.10.3 when OAuth2 is enabled. Concurrent requests to the /oauth/login endpoint can trigger a Go runtime panic due to unsynchronized access to a shared map, leading to service termination. This vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity and high impact on availability. There is currently no evidence of active exploitation, nor are there public exploit modules or proof-of-concept code available. Community discussion is minimal, with only two mentions identified.