fastschema CVE-2026-72582

The vulnerable endpoint /api/auth/local/recover must be network-accessible to the attacker - this is the only condition. No authentication is required (PR:N per CVSS vector). No special configuration beyond a default fastschema deployment with local authentication enabled is necessary. The attack requires no user interaction and works against any fastschema instance through v0.15.1 where the local auth provider is active and the recovery endpoint is reachable. Exploitation is limited by: (1) the local authentication module must be enabled (if fastschema is configured to use only external/OAuth providers, the vulnerable code path may not be reachable); and (2) impact is restricted to availability - an attacker cannot gain code execution, read data, or modify data through this vulnerability alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the exploitation profile: the attack is fully remote, requires no authentication, no user interaction, and no special attack complexity - a single malformed or crafted request to the /api/auth/local/recover endpoint is sufficient to bring down the server. The impact is limited to availability (complete process termination), with no confidentiality or integrity consequences. No EPSS score was provided in the source data, and the product is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The absence of a known public exploit code lowers immediate real-world risk, but the trivial exploitation path (AC:L, PR:N) means any threat actor capable of sending an HTTP request could weaponize this without specialized tooling. The SSVC automatable dimension is HIGH - this can be scripted and launched at scale against exposed instances. The primary mitigating factor is product prevalence: fastschema is a niche framework with a small deployment footprint, reducing aggregate exposure. Nevertheless, any organization running a publicly accessible fastschema instance should treat remediation as urgent given the zero-barrier-to-entry nature of the attack.

An attacker sends a single crafted HTTP POST request to the /api/auth/local/recover endpoint of an internet-exposed fastschema instance, providing input designed to trigger the error path in sendOTPEmail that returns a nil pointer. The nil dereference causes an unrecovered Go panic, immediately terminating the server process and taking the application offline for all users. No exploit code has been publicly identified, but the attack requires no authentication, no prior reconnaissance of the target, and no specialized tooling beyond a standard HTTP client.