CVE-2026-30223: OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

Vulnerability summary

CVE-2026-30223 is a high (CVSS 8.8) Improper Authentication vulnerability in olivetin. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-03-2026
   PublishedVulnerability first disclosed.
2. 09-03-2026
   Last modifiedVulnerability information updated.

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.