# CVE-2026-79664: Ech0 access token revocation bypass with never-expire tokens

Source: https://junglewise.ai/threats/cve-2026-79664-ech0-access-token-revocation-bypass-with-never-expire-tokens  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79664 · Severity: high · CVSS 7.4 · Published 2026-08-25

Ech0 is an open-source authentication and access control management service used to issue and revoke API tokens. A critical flaw prevents proper revocation of tokens configured to never expire, allowing attackers who steal such a token to maintain permanent authenticated access to APIs and services. The only way to invalidate a compromised token is to rotate the signing key globally, disrupting all users across the entire system.

Technologies: [github.com/lin-snow/ech0 (Go)](https://junglewise.ai/threats/technologies/github-com-lin-snow-ech0), [Lin-Snow Ech0](https://junglewise.ai/threats/technologies/ech0). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Lin-Snow](https://junglewise.ai/threats/vendors/lin-snow).

## Quick answers

**Is CVE-2026-79664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79664 being exploited in the wild.

**How severe is CVE-2026-79664?** High severity, with a CVSS score of 7.4, published 25 August 2026.

**Which products and versions are affected?** github.com/lin-snow/ech0 (Go) SEMVER:introduced=0,fixed=1.4.8-0.20260503041146-eab62379c795; Lin-Snow Ech0 < 4.7.3.

**Is there a fix for CVE-2026-79664?** Yes. github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503041146-eab62379c795 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79664 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79664?** Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503041146-eab62379c795 or later

  ```sh
  go get github.com/lin-snow/ech0@v1.4.8-0.20260503041146-eab62379c795
  ```


## Technical details

Ech0 before 4.7.3 fails to revoke access tokens created with expiry set to "never." The vulnerability stems from three independent failures in revocation logic: (1) the logout handler dereferences a nil ExpiresAt field when processing never-expire tokens, causing a panic and preventing the token from reaching the blacklist; (2) the RevokeToken function skips blacklist writes when remainTTL is zero; (3) the admin delete action removes the database record but does not call RevokeToken or write to the JTI blacklist. Once a never-expire token is stolen, it remains cryptographically valid indefinitely because JWT signature validation succeeds and the middleware does not consult a blacklist for such tokens. The only remediation is to rotate the JWT_SECRET, which invalidates all tokens for all users. This is a token authentication bypass with network-level attack surface.

## Affected products

- lin-snow Ech0 < 4.7.3

## Identifiers

- CVE-2026-79664
- GHSA-fpw6-hrg5-q5x5
- GO-2026-5375

## Timeline

- 2026-05-03: disclosed: GitHub Security Advisory published
- 2026-04-01: patched: Version 4.7.3 released (estimated based on advisory date)
- 2026-08-25: advisory: CVE-2026-79664 published

## References

- [https://github.com/lin-snow/Ech0/security/advisories/GHSA-fpw6-hrg5-q5x5](https://github.com/lin-snow/Ech0/security/advisories/GHSA-fpw6-hrg5-q5x5)
- [https://www.vulncheck.com/advisories/ech0-before-access-token-revocation-bypass](https://www.vulncheck.com/advisories/ech0-before-access-token-revocation-bypass)

## Related threats

- [Ech0 scope bypass in PUT /user endpoint via profile:read token](https://junglewise.ai/threats/cve-2026-79673-ech0-scope-bypass-in-put-user-endpoint-via-profile-read-token)
- [Ech0 authorization bypass in comment panel endpoints](https://junglewise.ai/threats/cve-2026-79672-ech0-authorization-bypass-in-comment-panel-endpoints)
- [Ech0 server-side request forgery in webhook URL validation](https://junglewise.ai/threats/cve-2026-79671-ech0-server-side-request-forgery-in-webhook-url-validation)
- [Ech0 stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-79670-ech0-stored-cross-site-scripting-in-file-upload)
- [Ech0 missing authorization on system log endpoints](https://junglewise.ai/threats/cve-2026-79669-ech0-missing-authorization-on-system-log-endpoints)