8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30223

CVE-2026-30223: OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30223

CVE-2026-30223:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260304231339-e97d8ecbd8d6	0.0.0-20260304231339-e97d8ecbd8d6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because OliveTin failed to validate the audience ('aud') claim of JSON Web Tokens (JWTs) when configured to use either a local public key (authJwtPubKeyPath) or an HMAC secret (authJwtHmacSecret). The analysis of the security patch (commit e97d8ecbd8d6) confirms this. The functions parseJwtTokenWithLocalKey and parseJwtTokenWithHMAC in service/internal/auth/otjwt/jwt.go were responsible for parsing these tokens. Originally, they called the jwt.Parse method without providing the required audience validation parameter. This oversight allowed a validly signed token, even if intended for a completely different service, to be accepted for authentication by OliveTin, breaking trust boundaries in multi-service environments. The patch remediates this by introducing a new function, parserOptionsWithAudience, which ensures that the configured audience (authJwtAud) is always passed to the jwt.Parse function, thereby enforcing proper audience validation.

Vulnerable functions

auth/otjwt.parseJwtTokenWithLocalKey

service/internal/auth/otjwt/jwt.go

This function parses a JWT using a local public key. Before the patch, the call to `jwt.Parse` did not include the `jwt.WithAudience` option, meaning it failed to validate the 'aud' (audience) claim in the token. This allowed a validly signed token intended for a different audience or service to be accepted for authentication.

auth/otjwt.parseJwtTokenWithHMAC

service/internal/auth/otjwt/jwt.go

This function parses a JWT using an HMAC secret. Similar to the local key method, the original implementation of this function did not validate the 'aud' (audience) claim of the JWT. The `jwt.Parse` function was called without an audience validation parameter, permitting an attacker to reuse a token from another service to authenticate.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.