Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-30224 OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs ou… https://www.cve.org/CVERecord?id=CVE-2026-30224
Post summary
The CVE‑2026‑30224 vulnerability in OliveTin permits command execution through the web interface and fails to revoke sessions before version 3000.11.1, suggesting a fix exists in newer releases.
CVE-2026-30224 OliveTin Session Persistence Vulnerability Allows Post-Logout Aut... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30224 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The entry briefly references CVE-2026-30224, links to a vulnerability page, and minimally describes a session persistence issue without providing actionable details or evidence of exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | olivetin | olivetin | - | - | - |