CVE-2026-79664

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.7.3

Description Failure to properly revoke access tokens created with the never-expire option allows attackers to maintain perpetual authenticated access following token theft. This occurs because three revocation mechanisms are flawed: the logout process panics when encountering a nil ExpiresAt field, the RevokeToken() function skips execution when remainTTL is zero, and the admin delete function fails to blacklist the JTI (JWT ID), leaving stolen tokens cryptographically valid until the JWT secret is rotated.

Recommendations Update to version 4.7.3 or later. Rotate the JWT secret to invalidate all existing tokens.