CVE-2026-30224

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.

• CWE-384
• CWE-613

• https://github.com/OliveTin/OliveTin/commit/d6a0abc3755d43107be1939567c52953bcbec3d5Patch
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1Product, Release Notes
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-gq2m-77hf-vwghExploit, Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3017The Smart Post Show – Post Grid, Post Carousel & Slider, and…7.2
• CVE-2026-3018The Newsletters plugin for WordPress is vulnerable to time-b…7.5
• CVE-2026-3020Identity based authorization bypass vulnerability (IDOR) tha…8.6
• CVE-2026-3021Non-relational SQL injection vulnerability (NoSQLi) in the W…6.5
• CVE-2026-3022Non-relational SQL injection vulnerability (NoSQLi) in the W…6.5
• CVE-2026-30223OliveTin gives access to predefined shell commands from a we…8.8
• CVE-2026-30225OliveTin gives access to predefined shell commands from a we…4.3
• CVE-2026-30226Svelte devalue is a JavaScript library that serializes value…7.5
• CVE-2026-30227MimeKit is a C# library which may be used for the creation a…5.3
• CVE-2026-30228Parse Server is an open source backend that can be deployed …4.9
• CVE-2026-30229Parse Server is an open source backend that can be deployed …7.2
• CVE-2026-3023Non-relational SQL injection vulnerability (NoSQLi) in the W…8.8