CVE-2026-30223

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30223", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T17:23:59.797Z", "datePublished": "2026-03-06T21:01:44.731Z", "dateUpdated": "2026-03-09T20:54:29.764Z"}, "containers": {"cna": {"title": "OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9"}, {"name": "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233", "tags": ["x_refsource_MISC"], "url": "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233"}, {"name": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"}], "affected": [{"vendor": "OliveTin", "product": "OliveTin", "versions": [{"version": "< 3000.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T21:01:44.731Z"}, "descriptions": [{"lang": "en", "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either \"authJwtPubKeyPath\" (local RSA public key) or \"authJwtHmacSecret\" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1."}], "source": {"advisory": "GHSA-g962-2j28-3cg9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30223", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:49:22.328936Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:54:29.764Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30223", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:49:22.328936Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:51:36.420Z"}}], "cna": {"title": "OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes", "source": {"advisory": "GHSA-g962-2j28-3cg9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OliveTin", "product": "OliveTin", "versions": [{"status": "affected", "version": "< 3000.11.1"}]}], "references": [{"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9", "name": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233", "name": "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1", "name": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either \"authJwtPubKeyPath\" (local RSA public key) or \"authJwtHmacSecret\" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T21:01:44.731Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30223", "state": "PUBLISHED", "dateUpdated": "2026-03-09T20:54:29.764Z", "dateReserved": "2026-03-04T17:23:59.797Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T21:01:44.731Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OliveTin", "vendor": "OliveTin", "versions": [{"status": "affected", "version": "< 3000.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*", "matchCriteriaId": "36F31F34-F899-413C-9A07-C14E32C66807", "versionEndExcluding": "3000.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either \"authJwtPubKeyPath\" (local RSA public key) or \"authJwtHmacSecret\" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1."}, {"lang": "es", "value": "OliveTin da acceso a comandos shell predefinidos desde una interfaz web. Antes de la versi\u00f3n 3000.11.1, cuando la autenticaci\u00f3n JWT est\u00e1 configurada usando 'authJwtPubKeyPath' (clave p\u00fablica RSA local) o 'authJwtHmacSecret' (secreto HMAC), el valor de audiencia configurado (authJwtAud) no se aplica durante el an\u00e1lisis del token. Como resultado, los tokens JWT firmados v\u00e1lidamente con una declaraci\u00f3n 'aud' incorrecta son aceptados para la autenticaci\u00f3n. Esto permite la autenticaci\u00f3n usando tokens destinados a una audiencia/servicio diferente. Este problema ha sido parcheado en la versi\u00f3n 3000.11.1."}], "id": "CVE-2026-30223", "lastModified": "2026-06-17T10:32:30.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30223", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:49:22.328936Z", "version": "2.0.3"}}]}, "published": "2026-03-06T21:16:16.113", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-345"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-345"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3000.11.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OliveTin", "source": "cna", "vendor": "OliveTin"}, "product": "olivetin", "vendor": "olivetin"}], "analysis": {"en": {"generated_at": "2026-04-17T12:18:21.967127+00:00", "value": {"mitigation_remediation": ["Upgrade OliveTin to version 3000.11.1 or later.", "Disable JWT authentication if it is not required for your environment.", "Ensure the audience claim (authJwtAud) is set correctly and validate only accepted audiences, if the configuration allows limiting acceptance."], "summary": {"action": "Patch Now", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The flaw affects OliveTin OliveTin, versions prior to 3000.11.1. The patch was released in the 3000.11.1 release. No other vendor or product versions are affected. If you are running any version older than 3000.11.1, the vulnerability is present.", "description_and_impact": "OliveTin\u2019s authentication mechanism allows predefined shell commands to be executed from a web interface. When JWT authentication is configured with a local RSA public key or an HMAC secret, the audience claim (authJwtAud) is not enforced during token parsing. As a result, a token that is correctly signed but contains an incorrect audience value is still accepted as valid. This flaw requires a valid signature but permits the use of tokens intended for a different audience or service, effectively bypassing authentication checks. The vulnerability is classified as an authentication bypass (CWE\u2011287) and an incorrect audience validation (CWE\u2011345).", "risk_and_exploitability": "Based on the description, OliveTin provides a web interface for predefined shell commands and uses JWT for authentication. The flaw occurs when a validly signed JWT contains an incorrect audience claim; the audience is not checked. Consequently, if an attacker has a JWT that is correctly signed for OliveTin but carries a different audience, that token will still be accepted, allowing the attacker to authenticate as an arbitrary user. The attack is therefore a remote network attack where the adversary supplies forged JWTs. It requires that the attacker already obtains a JWT with a valid signature for OliveTin; once that is achieved, the audience claim is ignored, and the attacker gains the ability to execute any command the application permits. The flaw is rated high severity with a CVSS score of 8.8, but the EPSS indicates a very low exploitation probability. The vulnerability is not included in the CISA KEV catalog. The risk remains significant because gaining authenticated access exposes execution privileges for arbitrary shell commands."}}}}, "created": "2026-03-09T10:06:55.876385+00:00", "updated": "2026-04-17T12:30:06.220453+00:00", "vendors": ["olivetin", "olivetin$PRODUCT$olivetin"]}