ots has a negative expire override that can bypass its secret retention policy
Date: 2026-05
Affected: go/github.com/Luzifer/ots
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-20
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

## Summary The `/api/create` endpoint accepted negative `expire` query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended. ## Impact Unauthenticated users could bypass configured retention expectations for secrets they create by sending `POST /api/create?expire=-1`. This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted. ## Affected versions Versions up to and including v1.21.4 are affected. ## Patched versions Fixed in v1.21.5. ## Workarounds Disable expiry overrides via `disableExpiryOverride: true` until upgrading. ## Credit Reported by Chai Cheng Xun via email.


Mitigations:

Architectural layers (MAESTRO):