CVE-2026-48154

CVE-2026-48154 describes a race condition in gorest’s InMemorySecret2FA store, where a package‑level plain map is accessed concurrently by login and twoFA handlers without synchronization. The result is a Go runtime fatal error for concurrent map read/write, causing a denial of service via proces...