CVE-2026-67437

## Summary OliveTin's OAuth2 login handler stores per-login state in an in-memory map (`registeredStates`) that grows unboundedly. States are added on every `/oauth/login` request but are **never deleted or expired**. An unauthenticated attacker can send millions of requests to `/oauth/login` to fill the map with state entries, exhausting server memory and causing a denial of service. This is **distinct from CVE-2026-28789** (concurrent map writes crash). That CVE was about the panic from unsynchronized map access — the fix added a `sync.RWMutex`. This vulnerability is about the **unbounded growth** of the map even WITH the mutex, as no cleanup mechanism exists. ## Affected Versions - All versions with OAuth2 support, including >= 3000.10.3 (which patched CVE-2026-28789) ## Details In `service/internal/auth/otoauth2/restapi_auth_oauth2.go`: ```go type OAuth2Handler struct { cfg *config.Config mu sync.RWMutex registeredStates map[string]*oauth2State // NEVER cleaned up registeredProviders map[string]*oauth2.Config } ``` The `HandleOAuthLogin` handler adds a new state on every request: ```go func (h *OAuth2Handler) HandleOAuthLogin(w http.ResponseWriter, r *http.Request) { state, _ := randString(16) // 24-byte base64 string // ... h.mu.Lock() h.registeredStates[state] = &oauth2State{ providerConfig: provider, providerName: providerName, Username: "", } h.mu.Unlock() // ... redirect to OAuth2 provider } ``` The `HandleOAuthCallback` handler updates existing states but never removes them: ```go func (h *OAuth2Handler) HandleOAuthCallback(w http.ResponseWriter, r *http.Request) { // ... h.mu.Lock() h.registeredStates[state].Username = userinfo.Username // Updates, never deletes h.registeredStates[state].Usergroup = ... h.mu.Unlock() } ``` There is **no TTL, no expiry check, no periodic cleanup, and no max size limit** on `regi