cve.bz

CVE-2026-79664

9.1 criticalEPSS 0.4%

Critical (9.1). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/lin-snow/ech0 1.4.8-0.20260503041146-eab62379c795.

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.

Severity

CVSS 4.0

9.1 critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.4 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE
CWE-613
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-fpw6-hrg5-q5x5Gogithub.com/lin-snow/ech0<1.4.8-0.20260503041146-eab62379c7951.4.8-0.20260503041146-eab62379c795
GO-2026-5375Gogithub.com/lin-snow/ech0<1.4.8-0.20260503041146-eab62379c7951.4.8-0.20260503041146-eab62379c795

References

Check your stackJSON