Access Token Revocation Bypass in Ech0 by Lin Snow

CVE-2026-79664

What is CVE-2026-79664?

Earlier versions of Ech0, specifically those prior to 4.7.3, contain a significant security flaw that permits attackers to sustain unauthorized access due to ineffective revocation of access tokens. This vulnerability arises when tokens created with the 'never-expire' option are not successfully invalidated, allowing malicious entities to exploit stolen tokens indefinitely. The failure of three distinct revocation mechanisms—logout procedures that malfunction with nil ExpiresAt fields, RevokeToken that bypasses revocation when the remainTTL is zero, and ineffective admin delete actions that do not blacklist token identifiers—creates a security loophole. Until the JWT secret is rotated, compromised tokens remain cryptographically valid.

References