GHSA-m3cx-mwpg-32jg: nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

Summary When OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. Details The OIDC login route is registered directly by WithOIDC: - internal/web/web.go:153 registers w.router.Get("/ui/oidc/login", o.HandleLogin). - internal/web/web.go:154 rate-limits only GET /ui/oidc/callback with w.rateLimitMiddleware("auth"). The normal /ui/* route group applies rate limiting to login/register form submissions, but this direct registration happens outside that group: - internal/web/web.go:287 through internal/web/web.go:292 show the rate-limited local login, TOTP, and register POST routes. The OIDC login handler allocates persistent server-side state before redirecting to the configured identity provider: - internal/web/oidc.go:105 defines HandleLogin. - internal/web/oidc.go:106 creates a random state token. - internal/web/oidc.go:112 calls o.rememberState(state). - internal/web/oidc.go:122 redirects to o.oauth.AuthCodeURL(state). The state storage has a TTL but no maximum size: - internal/web/oidc.go:24 through internal/web/oidc.go:26 define oidcStateTTL = 10 * time.Minute. - internal/web/oidc.go:353 through internal/web/oidc.go:358 sweep expired states and then add the new state to o.states. - internal/web/oidc.go:360 through internal/web/oidc.go:373 delete only expired states. Because the route is unauthenticated and not rate-limited, a remote client can repeatedly request /ui/oidc/login and force live state entries to accumulate for ten minutes. OIDC must be enabled for exposure. No IdP callback, valid credentials, or user