cve.bz

CVE-2026-30223

8.8 highEPSS 0.3%

High (8.8) in olivetin olivetin. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/OliveTin/OliveTin 0.0.0-20260304231339-e97d8ecbd8d6.

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWEs
CWE-345, CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g962-2j28-3cg9Gogithub.com/OliveTin/OliveTin<0.0.0-20260304231339-e97d8ecbd8d60.0.0-20260304231339-e97d8ecbd8d6
GO-2026-4622Gogithub.com/OliveTin/OliveTin<0.0.0-20260304231339-e97d8ecbd8d60.0.0-20260304231339-e97d8ecbd8d6

References

Check your stackJSON