Scope Bypass Vulnerability in Ech0 by Lin Snow

CVE-2026-79673

What is CVE-2026-79673?

The vulnerability in Ech0 before version 4.4.3 allows unauthorized write operations through the PUT /user endpoint. Although this endpoint is supposed to be secured with a read-only scope, malicious actors leveraging a profile:read access token can change an admin's password. This exploitation grants them the ability to log in with unrestricted session tokens, effectively bypassing all scope enforcement and granting them elevated privileges.

References