GO-2026-4623

vendorUSosv

OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session in github.com/OliveTin/OliveTin

view advisory published 2026-03-10Licence: per source

OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session in github.com/OliveTin/OliveTin. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/OliveTin/OliveTin before v0.0.0-20260304233115-d6a0abc3755d15.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-30224US	—	0.31% (24th)	—	2026-03-06
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although th…

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan