CVE-2026-30223
published 2026-03-06CVE-2026-30223: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.30%
21.7th percentile
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | olivetin_olivetin | >= 0 < 0.0.0-20260304231339-e97d8ecbd8d6 | 0.0.0-20260304231339-e97d8ecbd8d6 |
| olivetin | olivetin | < 3000.11.1 | 3000.11.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →JWT tokens with a mismatched or incorrect 'aud' (audience) claim are accepted by OliveTin prior to v3000.11.1 — monitor for JWT authentication attempts where the 'aud' claim does not match the configured 'authJwtAud' value ↗
- →Flag OliveTin instances running versions prior to 3000.11.1 with JWT authentication enabled via 'authJwtPubKeyPath' or 'authJwtHmacSecret' as vulnerable to audience bypass ↗
- ·The vulnerability only applies when JWT authentication is explicitly configured — instances not using 'authJwtPubKeyPath' or 'authJwtHmacSecret' are not affected by this specific bypass ↗
- ·The 'authJwtAud' configuration field is present but silently unenforced in vulnerable versions — operators may believe audience validation is active when it is not ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes in github.com/OliveTin/OliveTin
osv·2026-03-10
CVE-2026-30223 OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes in github.com/OliveTin/OliveTin
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes in github.com/OliveTin/OliveTin
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes in github.com/OliveTin/OliveTin
GHSA
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
ghsa·2026-03-05
CVE-2026-30223 [HIGH] CWE-287 OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
### Summary
When JWT authentication is configured using either:
- `authJwtPubKeyPath` (local RSA public key), or
- `authJwtHmacSecret` (HMAC secret),
the configured audience value (`authJwtAud`) is not enforced during token parsing.
As a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for authentication.
This allows authentication using tokens intended for a different audience/service.
### Details
**Affected Code**
File: `jwt.go`
Lines: 51–59, 144–157, 161–168
**Current Behavior**
Remote JWKS Mode (Correct):
```go
return jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud))
```
Audience validation is enforced.
Local Public Key Mode (Vulnerable):
```go
return
OSV
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
osv·2026-03-05
CVE-2026-30223 [HIGH] OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
### Summary
When JWT authentication is configured using either:
- `authJwtPubKeyPath` (local RSA public key), or
- `authJwtHmacSecret` (HMAC secret),
the configured audience value (`authJwtAud`) is not enforced during token parsing.
As a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for authentication.
This allows authentication using tokens intended for a different audience/service.
### Details
**Affected Code**
File: `jwt.go`
Lines: 51–59, 144–157, 161–168
**Current Behavior**
Remote JWKS Mode (Correct):
```go
return jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud))
```
Audience validation is enforced.
Local Public Key Mode (Vulnerable):
```go
return
No detection rules found.
No public exploits indexed.
2026-03-06
Published