CVE-2026-72582

Name of the Vulnerable Software and Affected Versions fastschema versions prior to 0.15.2

Description A NULL pointer dereference occurs when the server fails to validate that a pointer is non-nil before use. An unauthenticated remote attacker can trigger a fatal panic that crashes the server process by sending a single HTTP request to the '/api/auth/local/recover' endpoint. This issue is located in the sendOTPEmail() function within the pkg/auth/local.go file, where a pointer is dereferenced from an unchecked error path.

Recommendations Update to a version newer than 0.15.1. As a temporary workaround, restrict access to the '/api/auth/local/recover' endpoint to minimize the risk of exploitation.