CVE-2026-30223 - Vulnerability Analysis

Overview

OliveTin < 3000.11.1 contains a broken authentication caused by lack of audience claim enforcement in JWT tokens, letting attackers authenticate with tokens intended for different audiences, exploit requires JWT authentication configured.

Severity & Score

Impact

Attackers can authenticate using tokens meant for other services, potentially gaining unauthorized access.

Mitigation

Upgrade to version 3000.11.1 or later.

References

• https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-30223 - High (8.8) OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30223/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner