5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30224

CVE-2026-30224: OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30224

CVE-2026-30224:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260304233115-d6a0abc3755d15	0.0.0-20260304233115-d6a0abc3755d15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the session management of OliveTin, specifically in the logout process. The Logout function in service/internal/api/api.go was only clearing the client-side session cookie, but it failed to invalidate the corresponding session on the server. The evidence for this is the addition of the auth.RevokeSessionForProvider call within the Logout function in the patch, which explicitly adds the missing server-side session revocation logic.

The function GetUserSession in service/internal/auth/sessions.go is the function that allows the exploitation of this vulnerability. It retrieves sessions from the server's storage. Since the Logout function didn't remove the session, GetUserSession would still find and return the session, allowing an attacker to reuse an old session ID to stay authenticated. The patch introduces RevokeUserSession and RevokeSessionForProvider to delete the session from the storage, which prevents GetUserSession from retrieving it after logout.

Vulnerable functions

oliveTinAPI.Logout

service/internal/api/api.go

The `Logout` function was vulnerable because it did not invalidate the server-side session. The patch adds a call to `auth.RevokeSessionForProvider` to properly revoke the session upon logout. Before this change, only the client-side cookie was cleared, allowing an attacker with a stolen session cookie to maintain access.

GetUserSession

service/internal/auth/sessions.go

The `GetUserSession` function is the counterpart to the vulnerable `Logout` function. It retrieves a user's session from storage based on the session ID. Because the `Logout` function failed to remove the session from storage, this function would continue to return a valid session for a supposedly logged-out user, thus enabling session replay attacks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.