OliveTin does not invalidate server‑side session data when a user logs out. Although the browser cookie is cleared, the server retains the session until its default expiry of about one year, meaning an attacker who obtains a session cookie can continue authenticating after a user has supposedly logged out. This flaw permits a privileged attacker to bypass logout protections and gain unauthorized access to the web interface’s command functionality, which could lead to remote command execution on the host system.

Any installation of OliveTin running a version prior to 3000.11.1 is affected. The vulnerability exists in all OliveTin products listed under the CNA entry OliveTin:OliveTin. No specific deployment configurations are mentioned, so any exposed oliveTin instance could be at risk if it has not been updated.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is less than 1%, suggesting that exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web interface; it requires an attacker to capture a session cookie, which is feasible through network eavesdropping or phishing. Once in possession of the cookie, the attacker can maintain access until the server‑side session expires. Because the flaw involves server‑side session persistence rather than a code execution path, audit and network monitoring can provide early detection, though the most effective risk mitigation is patching.