CVE-2026-30223: OliveTin JWT Auth Bypass Vulnerability

CVE-2026-30223 Overview

CVE-2026-30223 is an authentication bypass vulnerability in OliveTin, a web application that provides access to predefined shell commands from a web interface. When JWT authentication is configured using either authJwtPubKeyPath (local RSA public key) or authJwtHmacSecret (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. This flaw allows validly signed JWT tokens with an incorrect aud claim to be accepted for authentication, enabling attackers to authenticate using tokens intended for different audiences or services.

Critical Impact

Attackers with access to JWT tokens intended for other services can bypass OliveTin authentication and gain unauthorized access to execute predefined shell commands, potentially leading to full system compromise.

Affected Products

• OliveTin versions prior to 3000.11.1

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-30223 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-30223

Vulnerability Analysis

This vulnerability falls into the category of Authentication Bypass (CWE-287) and Insufficient Verification of Data Authenticity (CWE-345). The core issue lies in the JWT token validation logic within OliveTin's authentication mechanism.

JWT tokens contain an aud (audience) claim that specifies the intended recipient of the token. This claim is a critical security control that prevents tokens issued for one service from being accepted by another. When properly implemented, a service should reject any JWT where the audience claim does not match its configured audience value.

In vulnerable versions of OliveTin, while the application allows administrators to configure an expected audience via the authJwtAud configuration option, this value is never actually checked against incoming tokens during the authentication process. The token signature is validated correctly, but the audience claim is ignored entirely.

This means that if an attacker obtains a validly signed JWT token from another service that shares the same signing key (RSA public key or HMAC secret), they can use that token to authenticate to OliveTin. Given that OliveTin provides a web interface to execute predefined shell commands, successful exploitation could lead to arbitrary command execution on the underlying system.

Root Cause

The root cause of this vulnerability is missing validation logic in the JWT parsing implementation. When OliveTin processes incoming JWT tokens for authentication, the code verifies the token's cryptographic signature to ensure it was issued by a trusted authority. However, the audience validation step that should compare the token's aud claim against the configured authJwtAud value is absent. This incomplete implementation of JWT validation violates the principle of defense in depth and the JWT specification's intended use of the audience claim.

Attack Vector

The attack requires network access to the OliveTin web interface and a validly signed JWT token. An attacker could exploit this vulnerability in several scenarios:

1. Multi-tenant environments: When multiple services share the same JWT signing infrastructure, an attacker with legitimate access to one service could reuse their token to access OliveTin
2. Compromised sibling services: If another application using the same signing key is compromised, attackers can use stolen tokens to access OliveTin
3. Token leakage: JWT tokens from other services that have been exposed through logs, errors, or other means can be repurposed for OliveTin authentication

The exploitation does not require user interaction and can be performed over the network. Since OliveTin provides shell command execution capabilities, successful authentication bypass could result in complete system compromise depending on the configured commands and the privileges of the OliveTin process.

Detection Methods for CVE-2026-30223

Indicators of Compromise

• Successful authentication events where the JWT aud claim does not match the configured authJwtAud value
• Authentication attempts using tokens with audience values belonging to other services
• Unusual shell command executions following authentication from unexpected sources
• Access logs showing authentication from IP addresses or clients that typically interact with different services

Detection Strategies

• Implement logging to capture the full JWT claims (excluding sensitive data) during authentication events
• Monitor for authentication patterns where the same token is used across multiple services
• Alert on successful authentications where the audience claim is unexpected or mismatched
• Review OliveTin access logs for unusual authentication timing or geographic patterns

Monitoring Recommendations

• Enable verbose logging in OliveTin to capture authentication details
• Correlate OliveTin authentication logs with logs from other services using the same signing infrastructure
• Monitor for command executions that follow suspicious authentication events
• Implement network monitoring to detect connections to OliveTin from unexpected sources

How to Mitigate CVE-2026-30223

Immediate Actions Required

• Upgrade OliveTin to version 3000.11.1 or later immediately
• Review authentication logs for any signs of audience claim mismatches or token reuse from other services
• Audit all systems sharing the same JWT signing keys to assess exposure
• Consider rotating JWT signing keys if token compromise is suspected
• Implement network segmentation to restrict access to the OliveTin interface

Patch Information

The vulnerability has been patched in OliveTin version 3000.11.1. The fix implements proper audience claim validation during JWT token parsing. Details of the patch can be found in the GitHub commit. The GitHub Security Advisory GHSA-g962-2j28-3cg9 provides additional information about this vulnerability.

The patched version can be obtained from the OliveTin releases page.

Workarounds

• Restrict network access to OliveTin to only trusted sources using firewall rules
• If possible, disable JWT authentication temporarily and use alternative authentication methods
• Implement an API gateway or reverse proxy that performs audience validation before requests reach OliveTin
• Use unique signing keys for OliveTin that are not shared with other services

# Example: Restrict OliveTin access using iptables
# Allow only specific trusted IP addresses to access OliveTin port
iptables -A INPUT -p tcp --dport 1337 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 1337 -s 192.168.1.101 -j ACCEPT
iptables -A INPUT -p tcp --dport 1337 -j DROP