Token Validation Issue in Shiori by Go Shiori

CVE-2026-71206

What is CVE-2026-71206?

The Shiori authentication system contains a vulnerability in the CheckToken function, which only validates the HMAC signature of JSON Web Tokens (JWTs). This design flaw allows unmodified claims.Account objects to be returned without re-fetching from the database. As a result, any modifications to the user account, such as deletions or role changes, do not affect active tokens. Thus, a deleted or demoted user's token retains the original owner-level permissions until the token naturally expires, which can last up to 30 days when 'remember me' is enabled, posing significant security risks.

References