CVE-2026-79664
Received Received - Intake

Ech0 Token Persistence Flaw via Expired Access Tokens

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79664
EUVD
EUVD-2026-65450

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ech0 ech0 to 4.7.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79664 is a flaw in Ech0 versions before 4.7.3 where access tokens set to never expire are not properly revoked. Three revocation systems fail: logout crashes due to missing expiration field, revocation skips tokens with zero remaining time, and admin deletion does not blacklist token identifiers. This lets stolen tokens remain valid indefinitely until JWT secret rotation.

Detection Guidance

Check Ech0 version with 'ech0 --version' or inspect package metadata. Look for never-expire tokens in logs or database queries for tokens without expiration fields. Monitor for failed logout attempts due to nil ExpiresAt causing HTTP 500 errors.

Impact Analysis

Attackers who steal never-expire tokens can maintain permanent unauthorized access to systems using Ech0. This could lead to data breaches, unauthorized actions, or persistent account compromise. The impact depends on the system's sensitivity and data exposure.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates timely revocation of access and breach notification. HIPAA requires safeguards against unauthorized access. The flaw undermines these standards by allowing indefinite unauthorized access.

Mitigation Strategies

Upgrade Ech0 to version 4.7.3 or later immediately. Rotate all JWT secrets to invalidate existing never-expire tokens. Review and revoke all never-expire tokens manually if upgrade is delayed. Monitor for unauthorized access attempts post-rotation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart