ots has a negative expire override that can bypass its secret retention policy
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
## Summary The `/api/create` endpoint accepted negative `expire` query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended. ## Impact Unauthenticated users could bypass configured retention expectations for secrets they create by sending `POST /api/create?expire=-1`. This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted. ## Affected versions Versions up to and including v1.21.4 are affected. ## Patched versions Fixed in v1.21.5. ## Workarounds Disable expiry overrides via `disableExpiryOverride: true` until upgrading. ## Credit Reported by Chai Cheng Xun via email.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/Luzifer/ots (Go) | before 1.21.5 | 1.21.5 | Patch available | GHSA-h5fq-653g-gxrm |
- github.com/Luzifer/ots (Go) Vendor— Affected before 1.21.5 Fixed in 1.21.5 Patch available GHSA-h5fq-653g-gxrm
Remediation
- Fix · GHSA-h5fq-653g-gxrm github.com/Luzifer/ots (Go) Fixed in 1.21.5 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-h5fq-653g-gxrm
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences