CVE-2026-79662: Ech0 OAuth Auth Bypass Vulnerability

CVE-2026-79662 Overview

CVE-2026-79662 is an OAuth redirect URI validation vulnerability in Ech0 through version 4.5.6. The flaw resides in the parseAndValidateClientRedirect function within internal/service/auth/auth.go. Ech0 validates only the scheme and host of a client-supplied redirect_uri against the admin-configured allowlist, ignoring the path, query, and fragment components. Attackers can craft a redirect_uri that matches an allowed origin while directing the OAuth flow to an attacker-influenced path. This weakness is classified under CWE-601: URL Redirection to Untrusted Site. The vulnerability is fixed in Ech0 4.7.3.

Critical Impact
Successful exploitation lets an attacker exchange a leaked one-time code for the victim's OAuth access and refresh tokens, achieving full account takeover.

Affected Products

Ech0 versions up to and including 4.5.6
Ech0 OAuth authentication service (internal/service/auth/auth.go)
Ech0 public POST /api/auth/exchange endpoint

Discovery Timeline

2026-08-25 - CVE-2026-79662 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79662

Vulnerability Analysis

Ech0 implements OAuth-style authentication that accepts a redirect_uri parameter from the client at login time. The parseAndValidateClientRedirect function parses this URI and compares it against an admin-defined allowlist. The comparison is incomplete because it evaluates only the URL scheme and host. The path, query string, and fragment are not validated against any policy. Ech0 then embeds the unvalidated redirect_uri into a signed state JSON Web Token (JWT) issued during login. After the OAuth exchange, the server redirects the victim to the attacker-supplied path with a one-time exchange code appended to the query string. The code can be traded at the public POST /api/auth/exchange endpoint for the victim's access and refresh tokens.

Root Cause

The root cause is incomplete URL comparison logic. Trusting the signed state JWT to carry an attacker-influenced URL propagates the flawed input downstream. The exchange endpoint has no additional binding between the code and the originally intended redirect destination.

Attack Vector

An attacker crafts a login link containing a redirect_uri whose scheme and host match an allowlisted origin but whose path points to an endpoint the attacker controls or can observe. The victim authenticates, and Ech0 redirects to the attacker-controlled path with the exchange code in the query string. If that path leaks the code via the Referer header, analytics beacons, server logs, or an open redirect on the trusted host, the attacker retrieves it and calls POST /api/auth/exchange to obtain tokens. The vulnerability requires user interaction and social engineering to lure the victim to the malicious login URL. Reference: GitHub Security Advisory GHSA-p64j-f4x9-wq66 and the VulnCheck Advisory on Ech0.

Detection Methods for CVE-2026-79662

Indicators of Compromise

Authentication requests containing a redirect_uri whose path or query differs from documented client callback endpoints.
Successful calls to POST /api/auth/exchange originating from IP addresses or user agents that differ from the associated login session.
Outbound Referer headers from allowlisted hosts carrying code= query parameters to third-party domains.

Detection Strategies

Parse Ech0 access logs and alert on OAuth login flows where the redirect_uri path is not among the expected callback paths for a given client.
Correlate login events with subsequent token exchanges and flag mismatched client, IP, or user-agent attributes between the two events.
Inspect web analytics and content delivery network (CDN) logs for code query parameters flowing to external destinations.

Monitoring Recommendations

Enable verbose auditing on the Ech0 authentication service and forward logs to a central SIEM for retention and correlation.
Monitor issuance of refresh tokens per user and alert on multiple issuances within short time windows.
Track outbound requests from allowlisted redirect hosts for signs of open redirect abuse or unexpected analytics exfiltration paths.

How to Mitigate CVE-2026-79662

Immediate Actions Required

Upgrade Ech0 to version 4.7.3 or later, which enforces full-URI validation against the allowlist.
Rotate OAuth client secrets and invalidate all outstanding access and refresh tokens after the upgrade.
Audit the admin-configured redirect_uri allowlist and remove any hosts that run analytics, open redirects, or third-party content.

Patch Information

The vendor released Ech0 4.7.3 to remediate CVE-2026-79662. The fix extends parseAndValidateClientRedirect to compare the full redirect_uri, including path, query, and fragment, against the configured allowlist before embedding it in the state JWT. Patch details are documented in the GitHub Security Advisory GHSA-p64j-f4x9-wq66.

Workarounds

Restrict the redirect allowlist to hosts that do not embed analytics, third-party scripts, or open redirects.
Terminate the OAuth callback at a dedicated, minimal handler that does not forward Referer headers or log query strings.
Reduce the lifetime of one-time exchange codes and bind them to the originating client IP where operationally feasible.

bash

# Configuration example
# Upgrade Ech0 using the container image tag for the fixed release
docker pull linsnow/ech0:4.7.3
docker stop ech0 && docker rm ech0
docker run -d --name ech0 -p 8080:8080 linsnow/ech0:4.7.3