Vulnerability · Published Aug 10, 2026 · Assigned by TuranSec

CVE-2026-72582fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint

High 7.5

In plain English

A high-severity null pointer dereference in fastschema from fastschema. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.

Affected products (as reported)

Vendor	Product	Versions
fastschema	fastschema	0 – through 0.15.1

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Product third-party-advisory
Vulnerable File technical-description