CVE-2026-72582

CVE-2026-72582 is a nil pointer dereference in fastschema's password recovery flow that allows unauthenticated attackers to crash the server via panic. The CVSS 7.5 score misrepresents the actual risk: the vulnerability isn't the nil dereference itself — it's that Go's panic model converts an error-handling omission into a server-wide kill switch, and the unauthenticated trigger vector converts a code defect into an exploitable DoS weapon. In most languages, dereferencing a nil pointer triggers a handled exception and the request fails. In Go, an unrecovered panic terminates the entire process. This is a fundamental language-design distinction that standard severity metrics treat as identical — both register as "server crash." But the blast radius differs substantially: when the password recovery endpoint panics, active sessions, pending token validations, and upstream identity provider callbacks are left in-flight. In containerized deployments, this can trigger restart cascades that briefly saturate load balancers. The crash doesn't just kill the server — it creates a window of degraded state across every system that depends on authentication. The "unchecked error path" in sendOTPEmail is the analytical pivot. Something in that function already failed — a configuration issue, a service timeout, a nil email template — and instead of returning an error up the stack, the code continued and dereferenced a pointer that was never initialized. This makes the crash contingent on prior state: the server runs stably until a specific email configuration problem occurs, at which point every subsequent recovery request kills it. You cannot detect this at deploy time with static analysis because the crash requires a transient failure state that staging environments rarely reproduce. The unauthenticated trigger is what elevates this from code quality issue to operational risk. Password recovery endpoints accept unauthenticated input by design, making them high-value targets. An attacker who discovers this CVE doesn't need credentials — they can repeatedly POST to /api/auth/local/recover and panic the server on demand. What defenders should check: first, whether sendOTPEmail has a nil check before pointer dereference and whether it returns errors from all failure paths; second, audit other authentication functions in the same module for the same pattern — nil-panic-in-authentication-flows is a recurring vulnerability family across Go frameworks, and the fix is always "add a nil check and return the error," which suggests the underlying architectural condition hasn't been addressed; third, review container restart policies and connection pool timeouts to understand what happens when this does panic in production. The CVSS 7.5 score reflects institutional learned helplessness — this class of vulnerability has been scored the same way for over a decade, not because 7.5 is accurate, but because the response protocol (one-line patch, CVE closed) has calcified.

Reviewed through automated stages and approved by a human before publication.