CVE-2026-28789: Olivetin

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.

Affected products

• Olivetin Olivetin: up to and including 3000.10.2

Published 2026-03-05. Last modified 2026-06-17.