CVE-2026-30224: Olivetin

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.

Affected products

• Olivetin Olivetin: before 3000.11.1 (fixed in 3000.11.1)

Published 2026-03-06. Last modified 2026-06-17.