Executive Summary

CVE-2026-30224 is a session fixation vulnerability in OliveTin versions prior to 3000.11.1. The issue arises because when a user logs out, the server does not invalidate the server-side session associated with that user. Although the browser cookie is cleared, the session identifier (SID) remains valid on the server until it expires, which can be about one year by default.

This means an attacker who has previously stolen or captured a valid session cookie can reuse it after the user logs out, effectively bypassing the logout process and continuing to authenticate as that user. The vulnerability is due to a failure to revoke or delete the session on the server side during logout, violating expected logout semantics.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with access to a stolen or captured session cookie to continue accessing the OliveTin application as the victim even after the victim has logged out. This results in a post-logout authentication bypass.

The impact includes persistent unauthorized access, which can lead to exposure of sensitive information or unauthorized actions within the application. Users may be misled into believing their session ended upon logout, while attackers can maintain access for up to the session expiry period (approximately one year by default).

• Risks are higher in environments with shared computers, cross-site scripting (XSS), session theft, proxy logs, malware, or browser compromise.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by verifying whether server-side sessions remain valid after a user logs out. Specifically, if a session cookie (SID) that was previously used can still be replayed to gain authenticated access after logout, the system is vulnerable.'}, {'type': 'paragraph', 'content': 'A practical detection method involves these steps:'}, {'type': 'list_item', 'content': 'Log in to the OliveTin web interface and capture the session cookie (SID).'}, {'type': 'list_item', 'content': 'Log out from the application, which clears the cookie client-side.'}, {'type': 'list_item', 'content': 'Attempt to reuse the captured SID cookie in subsequent requests to the server.'}, {'type': 'paragraph', 'content': 'If the server accepts the old SID cookie and grants authenticated access, the vulnerability is present.'}, {'type': 'paragraph', 'content': 'While no specific commands are provided in the resources, you can use tools like curl or browser developer tools to capture and replay cookies. For example, using curl to send a request with the old SID cookie:'}, {'type': 'list_item', 'content': 'curl -H "Cookie: SID=old_session_id" https://your-olivetin-server/path'}, {'type': 'paragraph', 'content': 'If the response indicates an authenticated session, the vulnerability exists.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation is to upgrade OliveTin to version 3000.11.1 or later, where the vulnerability has been fixed by properly revoking server-side sessions upon logout.

The fix ensures that when a user logs out, the server invalidates the session ID (SID) in its session storage, preventing reuse of stale session cookies.

If upgrading immediately is not possible, consider these temporary mitigations:

• Manually clear or expire server-side session storage to invalidate existing sessions.
• Reduce the session expiration time from the default (~1 year) to a much shorter period to limit the window of session reuse.
• Implement additional monitoring for suspicious reuse of old session cookies.

Useful 0 Not Useful 0