CVE-2026-79664 Ech0 before 4.7.3 Access Token Revocation Bypass
Attackers with stolen never-expire tokens maintain perpetual access because Ech0 fails to revoke them via logout, API, or admin actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79664?
CVE-2026-79664 is a critical vulnerability in lin-snow Ech0, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.
Weakness: CWE-613
Which versions are affected by CVE-2026-79664?
3 open source packages ship an affected version, including github.com/lin-snow/ech0.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503041146-eab62379c795 |
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503041146-eab62379c795 |
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503041146-eab62379c795 |
How do I fix CVE-2026-79664?
Upgrade github.com/lin-snow/ech0 to 1.4.8-0.20260503041146-eab62379c795 or later.
Is CVE-2026-79664 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79664 exists.
Sources
Also known as GHSA-3r5q-vfpj-wprr, GHSA-fpw6-hrg5-q5x5, GO-2026-5375.