What’s Vulnerable › Vulnerabilities

CVE-2026-30223: OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-06 · updated 2026-06-17
• Weakness: CWE-287

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.

Affected products

• OliveTin: before 3000.11.1 — fixed in 3000.11.1

How to fix

Upgrade to a fixed version: OliveTin 3000.11.1. Check the vendor advisory for mitigations.

References

• https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9

Get alerted when CVE-2026-30223 or the next vulnerability affects your stack