GHSA-h5fq-653g-gxrm
ots has a negative expire override that can bypass its secret retention policy
GHSA-h5fq-653g-gxrm is a medium vulnerability (CVSS 5.3) in github.com/Luzifer/ots, published May 5, 2026. No source lists public exploit code. Fixed in github.com/Luzifer/ots 1.21.5.
- Severity
- 5.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.21.5github.com/Luzifer/ots +1 more
Description
Summary
The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.
Impact
Unauthenticated users could bypass configured retention expectations for secrets they create by sending POST /api/create?expire=-1.
This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.
Affected versions
Versions up to and including v1.21.4 are affected.
Patched versions
Fixed in v1.21.5.
Workarounds
Disable expiry overrides via disableExpiryOverride: true until upgrading.
Credit
Reported by Chai Cheng Xun via email.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/Luzifer/otsGo | through 1.21.4 | 1.21.5 |
github.com/Luzifer/otsGo | before 1.21.5 | 1.21.5 |
What each source reports
GitHub Advisories Score used
ots has a negative expire override that can bypass its secret retention policy
Summary
The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.
Impact
Unauthenticated users could bypass configured retention expectations for secrets they create by sending POST /api/create?expire=-1.
This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.
Affected versions
Versions up to and including v1.21.4 are affected.
Patched versions
Fixed in v1.21.5.
Workarounds
Disable expiry overrides via disableExpiryOverride: true until upgrading.
Credit
Reported by Chai Cheng Xun via email.
- Record
GHSA-h5fq-653g-gxrm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
ots has a negative expire override that can bypass its secret retention policy
Summary
The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.
Impact
Unauthenticated users could bypass configured retention expectations for secrets they create by sending POST /api/create?expire=-1.
This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.
Affected versions
Versions up to and including v1.21.4 are affected.
Patched versions
Fixed in v1.21.5.
Workarounds
Disable expiry overrides via disableExpiryOverride: true until upgrading.
Credit
Reported by Chai Cheng Xun via email.
- Record
GHSA-h5fq-653g-gxrm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGO-2026-5413No score
ots has a negative expire override that can bypass its secret retention policy in github.com/Luzifer/ots
ots has a negative expire override that can bypass its secret retention policy in github.com/Luzifer/ots
- Record
GO-2026-5413- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.