When OIDC is enabled, "GET /ui/oidc/login" is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for "10m". Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow "OIDC.states" for the full state TTL, bounded by request throughput rather than by configured auth rate limits.