Authentication Bypass Vulnerability in Ech0 by Lin Snow

CVE-2026-79668

What is CVE-2026-79668?

Ech0, prior to version 4.7.3, is susceptible to an authentication bypass issue within the PUT /api/echo/like/:id API endpoint. This vulnerability enables attackers to manipulate engagement metrics without mandatory identity verification or adherence to rate limits. By exploiting this flaw, unauthorized users can submit multiple requests to artificially inflate the 'fav_count' for any known echo identifier, thus endangering the reliability of engagement metrics and the integrity of social ranking systems.

References