https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:46:37.613521+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275137 EUVD-2026-275137 2026-10-06T18:46:37.616953+00:00 EUVD-2026-275137 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30224 fkie_cve-2026-30224 2026-10-06T18:46:37.616985+00:00

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.

 https://cve.radiocsirt.org/vuln/ghsa-gq2m-77hf-vwgh GHSA-gq2m-77hf-vwgh — OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session 2026-10-06T18:46:37.617020+00:00

Affected: Go: github.com/OliveTin/OliveTin

### Summary OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year).

An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass.

This is a session management flaw that violates expected logout semantics.

### Details During logout: ``` // Logout only clears browser cookie response.Header().Set("Set-Cookie", localCookie.String()) ``` However, the server still accepts the session: ``` session := sessionStorage.Providers[provider].Sessions[sid] ... return session ``` The SID is not deleted from sessionStorage.

Why vulnerable: Logout does not remove the SID from sessionStorage; old cookie is still accepted until expiry (~1 year).

File: [api.go](app://-/index.html?hostId=local#), [sessions.go](app://-/index.html?hostId=local#), [local.go](app://-/index.html?hostId=local#) Lines: api.go:392-427; sessions.go:39-59, 61-80; local.go:32-47 Behavior - Login → receive SID cookie - Logout → cookie cleared client-side - Replay old SID manually → still authenticated

Expected: - Logout invalidates session immediately

Actual: - Old SID remains usable until expiry

### PoC

Minimal config ``` listenAddressSingleHTTPFrontend: 0.0.0.0:16642 authRequireGuestsToLogin: true

authLocalUsers: enabled: true users: - username: low usergroup: users…