CVE-2026-71206: Shiori Auth Bypass Vulnerability

CVE-2026-71206 Overview

CVE-2026-71206 affects Shiori, an open-source bookmark manager written in Go. The vulnerability resides in the CheckToken function within internal/domains/auth.go. The function validates only the JSON Web Token (JWT) HMAC signature and trusts the embedded claims.Account object without re-fetching account state from the database. Shiori implements no session store or token revocation mechanism. Deleted accounts and demoted owners retain full privileges through their existing tokens until natural expiry, which can reach 30 days when the remember me option is enabled. This weakness is classified under [CWE-613] Insufficient Session Expiration.

Critical Impact
A demoted or deleted owner account can continue performing owner-level operations for up to 30 days using a previously issued JWT.

Affected Products

Shiori bookmark manager (go-shiori/shiori)
Deployments using JWT authentication with the CheckToken function in internal/domains/auth.go
Instances configured with extended session lifetimes via remember me

Discovery Timeline

2026-08-05 - CVE-2026-71206 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71206

Vulnerability Analysis

Shiori's authentication layer relies on stateless JWT validation. When a client presents a token, CheckToken verifies the HMAC signature against the server's secret and decodes the claims.Account payload. The function returns this decoded object directly to callers as the authenticated principal.

The design assumes JWT claims remain authoritative for the token's lifetime. Administrators who delete a user, revoke owner privileges, or otherwise modify account state cannot invalidate outstanding tokens. The server never consults the database to confirm the account still exists or retains the claimed role.

Attackers who obtain a valid token, whether through insider misuse, credential theft, or account compromise, retain their original privileges until the token expires. With remember me enabled, the exposure window extends to 30 days.

Root Cause

The root cause is missing server-side session state. The application trusts claims embedded in the JWT without a revocation list, session store, or per-request account lookup. There is no token_version field, database check, or revocation cache to invalidate compromised or stale tokens.

Attack Vector

Exploitation requires a previously issued valid JWT. An attacker who obtains an owner-level token, or who has their own owner role revoked, can continue calling privileged Shiori endpoints over the network. Requests succeed because signature validation passes and the embedded role claim is honored. No user interaction is required, and attack complexity is low.

The vulnerability mechanism is described in the Shiori GitHub repository. No verified proof-of-concept code is required beyond replaying an unexpired token against the API.

Detection Methods for CVE-2026-71206

Indicators of Compromise

Authenticated API requests from user IDs that no longer exist in the Shiori database.
Owner-level operations performed by accounts recently demoted to a regular role.
JWTs presenting exp values reflecting 30-day lifetimes tied to accounts that have been removed or modified.

Detection Strategies

Correlate authentication logs against the current account table to flag tokens belonging to deleted or demoted users.
Alert on privileged actions such as user management or configuration changes performed by accounts whose current role does not match the JWT claim.
Monitor for token reuse from new IP addresses or user agents following administrative account changes.

Monitoring Recommendations

Ingest Shiori application logs and authentication events into a centralized logging platform for retention and correlation.
Track the volume of long-lived remember me sessions and review outliers.
Establish baseline behavior for each owner account and alert on deviations after any role change event.

How to Mitigate CVE-2026-71206

Immediate Actions Required

Rotate the JWT signing secret to invalidate all outstanding tokens across the deployment.
Disable the remember me feature or reduce token lifetimes to the shortest operationally acceptable value.
Audit the owner role membership and remove any unnecessary privileged accounts.
Force reauthentication for all users following any account deletion or role change.

Patch Information

No vendor patch is referenced in the NVD entry at publication. Monitor the Shiori GitHub repository for upstream fixes that add database-backed session validation or a token revocation mechanism.

Workarounds

Deploy a reverse proxy that validates the JWT subject against the live Shiori user database on each request.
Shorten the JWT expiry configuration so that stale tokens naturally expire within minutes rather than days.
Rotate the HMAC signing secret whenever an owner account is deleted or demoted to invalidate all existing tokens.

bash

# Configuration example: rotate the JWT signing secret and restart Shiori
export SHIORI_HTTP_SECRET_KEY="$(openssl rand -hex 64)"
systemctl restart shiori