PT-2026-41410 · Go · Github.Com/Luzifer/Ots

Publicado 2026-05-05 · Atualizado 2026-05-05

OSV

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.

Impact

Unauthenticated users could bypass configured retention expectations for secrets they create by sending POST /api/create?expire=-1.

This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.

Affected versions

Versions up to and including v1.21.4 are affected.

Patched versions

Fixed in v1.21.5.

Workarounds

Disable expiry overrides via disableExpiryOverride: true until upgrading.

Credit

Reported by Chai Cheng Xun via email.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

GHSA-H5FQ-653G-GXRM

Produtos afetados

Github.Com/Luzifer/Ots

Referências · 5

• https://github.com/Luzifer/ots · Nota
• https://github.com/Luzifer/ots/commit/3511bd18a2bec75bd9c6b4d513f2a90ccf4209b7 · Nota
• https://github.com/Luzifer/ots/security/advisories/GHSA-h5fq-653g-gxrm · Nota
• https://github.com/Luzifer/ots/releases/tag/v1.21.5 · Nota
• https://osv.dev/vulnerability/GHSA-h5fq-653g-gxrm · Aviso do Fabricante