VulnerabilityAnalyzed

CVE-2026-30223

This allows authentication using tokens intended for a different audience/service.

HIGH 8.8EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-287, CWE-345
Affected: olivetin/olivetin
Source: security-advisories@github.com

References

https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233Patch
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1Product, Release Notes
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.