by Kastro
Paper/Archive/CVE-2026-79664

CVE-2026-79664

lin-snow Ech0 — Ech0 before 4.7.3 Access Token Revocation Bypass

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 29.3.293 × 205.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.

Affected

ProductAffectedFixed inSource
Ech0< 4.7.34.7.3CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/lin-snow/Ech0/security/advisories/GHSA-fpw6-hrg5-q5x5writeupvulncheck.com/advisories/ech0-before-access-token-revocation-bypass