EUVD-2026-275136

fkie_cve-2026-30223

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.

GHSA-g962-2j28-3cg9 — OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

Affected: Go: github.com/OliveTin/OliveTin

### Summary

When JWT authentication is configured using either:

- `authJwtPubKeyPath` (local RSA public key), or - `authJwtHmacSecret` (HMAC secret),

the configured audience value (`authJwtAud`) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service.

### Details

**Affected Code**

File: `jwt.go` Lines: 51–59, 144–157, 161–168

**Current Behavior**

Remote JWKS Mode (Correct): ```go return jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud)) ``` Audience validation is enforced.

Local Public Key Mode (Vulnerable): ```go return jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... }) ``` No `jwt.WithAudience()` option is provided.

HMAC Mode (Vulnerable): ```go return jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... }) ``` No `jwt.WithAudience()` option is provided.

**Why This Is Vulnerable:** `authJwtAud` is ignored for `authJwtPubKeyPath` and `authJwtHmacSecret` modes, so wrong-audience tokens are accepted.

### PoC

1. **Configure OliveTin**

Use a minimal config with JWT local key authentication: ```yaml authJwtPubKeyPath: ./public.pem authJwtHeader: Authorization authJwtClaimUsername: sub authJwtAud: expected-audience

authRequireGuestsToLogin: true ```

2. **Generate a Wrong-Audience Token** ```python python3 -…

Most recent entries from all

EUVD-2026-275136

fkie_cve-2026-30223

GHSA-g962-2j28-3cg9 — OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes