OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin Unauthorized Action Output Disclosure via EventStream

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go

OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin: View permission not being checked when returning dashboards

OliveTin: RestartAction always runs actions as guest

OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration