CVE-2026-48154

Name of the Vulnerable Software and Affected Versions gorest (affected versions not specified)

Description A race condition exists in the InMemorySecret2FA in-memory 2FA secret store due to the use of a bare Go map without proper synchronization. Multiple HTTP handlers concurrently read from, write to, and delete entries from this shared map. Because the Go runtime detects unsynchronized concurrent map access, it triggers an unrecoverable fatal error, resulting in a complete process crash and a denial of service. This issue can be triggered when multiple users log in simultaneously or when one user logs in while another performs 2FA verification.

Recommendations Implement a synchronization primitive, such as sync.RWMutex, to wrap the InMemorySecret2FA map within a store structure to ensure thread-safe access. As a temporary mitigation, restrict the number of concurrent requests to 2FA-related endpoints to reduce the likelihood of a race condition.