CVE-2026-79664: Ech0 access token revocation bypass with never-expire tokens

CVE-2026-79664 · Severity: high · CVSS 7.4 · Published 2026-08-25

Ech0 is an open-source authentication and access control management service used to issue and revoke API tokens. A critical flaw prevents proper revocation of tokens configured to never expire, allowing attackers who steal such a token to maintain permanent authenticated access to APIs and services. The only way to invalidate a compromised token is to rotate the signing key globally, disrupting all users across the entire system.

Technologies: github.com/lin-snow/ech0 (Go), Lin-Snow Ech0. Vendors: Go, Lin-Snow.

Quick answers

Is CVE-2026-79664 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79664 being exploited in the wild.
How severe is CVE-2026-79664?
High severity, with a CVSS score of 7.4, published 25 August 2026.
Which products and versions are affected?
github.com/lin-snow/ech0 (Go) SEMVER:introduced=0,fixed=1.4.8-0.20260503041146-eab62379c795; Lin-Snow Ech0 < 4.7.3.
Is there a fix for CVE-2026-79664?
Yes. github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503041146-eab62379c795 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79664 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-79664?
Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503041146-eab62379c795 or later
    go get github.com/lin-snow/ech0@v1.4.8-0.20260503041146-eab62379c795

Technical details

Ech0 before 4.7.3 fails to revoke access tokens created with expiry set to "never." The vulnerability stems from three independent failures in revocation logic: (1) the logout handler dereferences a nil ExpiresAt field when processing never-expire tokens, causing a panic and preventing the token from reaching the blacklist; (2) the RevokeToken function skips blacklist writes when remainTTL is zero; (3) the admin delete action removes the database record but does not call RevokeToken or write to the JTI blacklist. Once a never-expire token is stolen, it remains cryptographically valid indefinitely because JWT signature validation succeeds and the middleware does not consult a blacklist for such tokens. The only remediation is to rotate the JWT_SECRET, which invalidates all tokens for all users. This is a token authentication bypass with network-level attack surface.

Affected products

  • lin-snow Ech0 < 4.7.3

Identifiers

  • CVE-2026-79664
  • GHSA-fpw6-hrg5-q5x5
  • GO-2026-5375

Timeline

  • 2026-05-03: disclosed: GitHub Security Advisory published
  • 2026-04-01: patched: Version 4.7.3 released (estimated based on advisory date)
  • 2026-08-25: advisory: CVE-2026-79664 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.