CVE-2026-79662
Received Received - Intake

OAuth Redirect URI Validation Flaw in Ech0

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query, and fragment components. The redirect_uri is embedded into the signed state JWT at login time without validation. An attacker can craft a redirect_uri whose host matches an allowed origin but whose path is attacker-influenced; after the OAuth exchange the victim is redirected to that path with a one-time exchange code in the query string. If the code leaks (e.g., via Referer, analytics, or an open redirect on that host), the attacker can trade it at the public POST /api/auth/exchange endpoint for the victim's access and refresh tokens. Fixed in 4.7.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79662
EUVD
EUVD-2026-65452

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lin-snow ech0 to 4.7.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79662 is an OAuth redirect URI validation flaw in Ech0 versions up to 4.5.6. The application only checks the scheme and host of redirect URIs against an allowlist, ignoring paths, queries, and fragments. Attackers exploit this by crafting malicious URIs with allowed hosts but attacker-controlled paths. After OAuth authentication, victims are redirected to these paths, potentially leaking exchange codes via Referer headers or analytics. Attackers then use these codes to obtain access and refresh tokens.

Detection Guidance

Check Ech0 version with 'curl -s http://<ech0-server>/api/version | grep version' or similar. If version is <=4.5.6, the system is vulnerable. Inspect OAuth redirect URI handling in logs for mismatches between allowed hosts and actual redirect paths.

Impact Analysis

If you use Ech0 versions before 4.7.3, an attacker could trick you into clicking a malicious link. After OAuth login, you might be redirected to an attacker-controlled path, exposing your exchange code. If this code leaks, the attacker can steal your access and refresh tokens, gaining full account access. This could lead to unauthorized data access, account takeover, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, or loss of control over personal health information, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade Ech0 to version 4.7.3 or later immediately. Configure strict redirect URI validation to enforce exact matching including path, query, and fragment components. Disable or audit any open redirect endpoints on allowed hosts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart