https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:22:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275137 EUVD-2026-275137 https://cve.radiocsirt.org/vuln/euvd-2026-275137 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30224 <p>OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.</p> <p>OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30224 https://cve.radiocsirt.org/vuln/ghsa-gq2m-77hf-vwgh <p><strong>Affected:</strong> Go: github.com/OliveTin/OliveTin</p> <p>### Summary OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year).</p> <p>An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass.</p> <p>This is a session management flaw that violates expected logout semantics.</p> <p>### Details During logout: ``` // Logout only clears browser cookie response.Header().Set(&#34;Set-Cookie&#34;, localCookie.String()) ``` However, the server still accepts the session: ``` session := sessionStorage.Providers[provider].Sessions[sid] ... return session ``` The SID is not deleted from sessionStorage.</p> <p>Why vulnerable: Logout does not remove the SID from sessionStorage; old cookie is still accepted until expiry (~1 year).</p> <p>File: [api.go](app://-/index.html?hostId=local#), [sessions.go](app://-/index.html?hostId=local#), [local.go](app://-/index.html?hostId=local#) Lines: api.go:392-427; sessions.go:39-59, 61-80; local.go:32-47 Behavior - Login → receive SID cookie - Logout → cookie cleared client-side - Replay old SID manually → still authenticated</p> <p>Expected: - Logout invalidates session immediately</p> <p>Actual: - Old SID remains usable until expiry</p> <p>### PoC</p> <p>Minimal config ``` listenAddressSingleHTTPFrontend: 0.0.0.0:16642 authRequireGuestsToLogin: true</p> <p>authLocalUsers: enabled: true users: - username: low usergroup: users…</p> <p><strong>Affected:</strong> Go: github.com/OliveTin/OliveTin</p> <p>### Summary OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year).</p> <p>An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass.</p> <p>This is a session management flaw that violates expected logout semantics.</p> <p>### Details During logout: ``` // Logout only clears browser cookie response.Header().Set(&#34;Set-Cookie&#34;, localCookie.String()) ``` However, the server still accepts the session: ``` session := sessionStorage.Providers[provider].Sessions[sid] ... return session ``` The SID is not deleted from sessionStorage.</p> <p>Why vulnerable: Logout does not remove the SID from sessionStorage; old cookie is still accepted until expiry (~1 year).</p> <p>File: [api.go](app://-/index.html?hostId=local#), [sessions.go](app://-/index.html?hostId=local#), [local.go](app://-/index.html?hostId=local#) Lines: api.go:392-427; sessions.go:39-59, 61-80; local.go:32-47 Behavior - Login → receive SID cookie - Logout → cookie cleared client-side - Replay old SID manually → still authenticated</p> <p>Expected: - Logout invalidates session immediately</p> <p>Actual: - Old SID remains usable until expiry</p> <p>### PoC</p> <p>Minimal config ``` listenAddressSingleHTTPFrontend: 0.0.0.0:16642 authRequireGuestsToLogin: true</p> <p>authLocalUsers: enabled: true users: - username: low usergroup: users…</p> https://cve.radiocsirt.org/vuln/ghsa-gq2m-77hf-vwgh