{"id":"EUVD-2026-65450","enisaUuid":"1f6608b9-6fd8-3344-b63c-468082dc1fc2","description":"Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.","datePublished":"Aug 25, 2026, 11:33:27 AM","dateUpdated":"Oct 8, 2026, 3:25:14 PM","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-fpw6-hrg5-q5x5\nhttps://www.vulncheck.com/advisories/ech0-before-access-token-revocation-bypass\n","aliases":"CVE-2026-79664\nGHSA-3r5q-vfpj-wprr\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"859fcb6a-3fd3-3af4-a76e-ebd864b205c7","product":{"name":"Ech0","vendor":{"name":"lin-snow"}},"product_version":"0 \u003c4.7.3"}],"enisaIdVendor":[{"id":"a33f860e-d2d9-36f1-8124-167b5129ad41","vendor":{"name":"lin-snow"}}],"enisaIdVulnerability":[{"id":"3708ada8-53e7-32e9-bd14-bd9bc865cdae","vulnerability":{"id":"GHSA-3r5q-vfpj-wprr","description":"Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.","datePublished":"Aug 25, 2026, 12:31:26 PM","dateUpdated":"Aug 25, 2026, 12:31:26 PM","baseScore":0.0,"references":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-fpw6-hrg5-q5x5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-79664\nhttps://www.vulncheck.com/advisories/ech0-before-access-token-revocation-bypass\n","enisa_id":"EUVD-2026-65450\n","aliases":"CVE-2026-79664\nGHSA-3r5q-vfpj-wprr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"641a4ef2-1c77-3336-a40c-c76a47704c3e","vulnerability":{"id":"CVE-2026-79664","description":"Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.","datePublished":"Aug 25, 2026, 11:33:27 AM","dateUpdated":"Oct 8, 2026, 3:25:14 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-fpw6-hrg5-q5x5\nhttps://www.vulncheck.com/advisories/ech0-before-access-token-revocation-bypass\n","enisa_id":"EUVD-2026-65450\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Nov 5, 2026, 7:15:39 AM","vulnerabilityProduct":[{"id":"c7388c37-2dab-36bf-aaf8-f6a3ec32883e","product":{"name":"Ech0","vendor":{"name":"lin-snow"}},"product_version":"0 \u003c4.7.3"}],"vulnerabilityVendor":[{"id":"3bcac9ec-b5d8-3dc2-ab69-1164037e87b2","vendor":{"name":"lin-snow"}}]}}],"enisaIdAdvisory":[]}