Cloudanix VulnDB

GHSA-g962-2j28-3cg9

High · 8.8

OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

CVSS

8.8

EPSS

—

Published

Mar 5, 2026

CISA due date

—

The record

When JWT authentication is configured using either: - `authJwtPubKeyPath` (local RSA public key), or - `authJwtHmacSecret` (HMAC secret), the configured audience value (`authJwtAud`) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities