CVE-2026-30224: OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

Vulnerability summary

CVE-2026-30224 is a medium (CVSS 5.4) Session Fixation vulnerability in olivetin. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-03-2026
   PublishedVulnerability first disclosed.
2. 09-03-2026
   Last modifiedVulnerability information updated.

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-613DEPRECATED: Insufficient Session ExpirationThis entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.