GHSA-h5fq-653g-gxrm ots has a negative expire override that can bypass its secret retention policy
Unauthenticated attackers can bypass secret retention policies by sending negative expiry values, causing secrets to persist longer than intended.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-h5fq-653g-gxrm?
GHSA-h5fq-653g-gxrm is a vulnerability in github.com/Luzifer/ots, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.
Impact
Unauthenticated users could bypass configured retention expectations for secrets they create by sending POST /api/create?expire=-1.
This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.
Affected versions
Versions up to and including v1.21.4 are affected.
Patched versions
Fixed in v1.21.5.
Workarounds
Disable expiry overrides via disableExpiryOverride: true until upgrading.
Credit
Reported by Chai Cheng Xun via email.
Which versions are affected by GHSA-h5fq-653g-gxrm?
3 open source packages ship an affected version, including github.com/Luzifer/ots.
| Package | Affected | Fixed in |
|---|---|---|
github.com/Luzifer/ots Go | All versions | 1.21.5 |
github.com/Luzifer/ots Go | All versions | 1.21.5 |
github.com/Luzifer/ots Go | All versions | 1.21.5 |
How do I fix GHSA-h5fq-653g-gxrm?
Upgrade github.com/Luzifer/ots to 1.21.5 or later.
Is GHSA-h5fq-653g-gxrm being exploited?
There is no known exploitation of GHSA-h5fq-653g-gxrm in the wild and no public exploit code.
Sources
Also known as GO-2026-5413.