Access Control Vulnerability in OliveTin Web Interface
CVE-2026-30223

8.8HIGH

Key Information:

Vendor

Olivetin

Status
Olivetin
Vendor
CVE Published:
6 March 2026

What is CVE-2026-30223?

The OliveTin web application prior to version 3000.11.1 exhibits a vulnerability related to JWT authentication. When configured with either a local RSA public key or HMAC secret, the application fails to enforce the audience value during token parsing. This allows unauthorized access if validly signed JWT tokens containing an incorrect audience claim are used. Users are encouraged to upgrade to version 3000.11.1 to mitigate this risk.

Affected Version(s)

OliveTin < 3000.11.1

References

https://github.com/OliveTin/OliveTin/security/advisories/...
x_refsource_CONFIRM
https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6b...
x_refsource_MISC
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.