CVE-2026-30223

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-302245.4OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side se CVE-2026-302254.3OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vul CVE-2026-302267.5Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6 CVE-2026-302275.3MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail Extension (MIME), as CVE-2026-302284.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-al CVE-2026-302297.2Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-al CVE-2026-30238.8Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-CVE-2026-302307.5Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail e CVE-2026-302315.3Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and dir CVE-2026-302329.6Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.CVE-2026-302334.3OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allow CVE-2026-302346.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permi