Executive brief
fastschema is a backend-as-a-service platform with a headless CMS. An unauthenticated attacker can crash the entire server by sending a single HTTP request to the password recovery endpoint, causing service outage and disrupting all users' access to the platform.
Technical details
A NULL pointer dereference vulnerability exists in the sendOTPEmail function in pkg/auth/local.go. The function dereferences a pointer obtained from an unchecked error path without validating that the pointer is non-nil, triggering a fatal panic. The vulnerable code path is triggered when an unauthenticated attacker sends a recovery request to the /api/auth/local/recover endpoint, causing the entire server process to terminate. No authentication is required and the attack requires only a single HTTP request. No patch information has been publicly disclosed.
Affected products
- fastschema fastschema through v0.15.1
Timeline
- 2026-08-10: disclosed