CVE-2026-79664: Ech0 Auth Bypass Vulnerability

CVE-2026-79664 Overview

CVE-2026-79664 is an access token revocation bypass in Ech0 versions before 4.7.3. The application fails to revoke JSON Web Tokens (JWTs) that were issued with the never-expire option. Three independent revocation paths break: logout panics on a nil ExpiresAt field, RevokeToken skips processing when remainTTL equals zero, and the administrator delete function does not blacklist the token's JTI claim. Attackers who steal a never-expire token retain authenticated access until the JWT signing secret is rotated. This weakness maps to [CWE-613: Insufficient Session Expiration].

Critical Impact
Stolen never-expire access tokens remain cryptographically valid indefinitely, granting persistent authenticated access even after logout, explicit revocation, or administrator deletion.

Affected Products

Ech0 versions before 4.7.3
Deployments using JWT access tokens issued with the never-expire option
Instances relying on logout, RevokeToken, or admin delete for session termination

Discovery Timeline

2026-08-25 - CVE-2026-79664 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79664

Vulnerability Analysis

Ech0 issues JWTs that can be created without an expiration time. The server-side revocation logic assumes every token has a populated ExpiresAt claim and a positive remaining time-to-live. When either assumption fails, revocation silently or catastrophically fails. Because JWTs are stateless and cryptographically signed, a token that is never blacklisted remains trusted on every subsequent request. The only remediation available before version 4.7.3 is rotating the JWT signing secret, which invalidates every issued token across all users.

Root Cause

The root cause is a design flaw in the token lifecycle. The logout handler dereferences the ExpiresAt field without a nil check and panics when the field is absent on never-expire tokens. The RevokeToken function computes remainTTL from ExpiresAt and returns early when the value is zero, skipping the blacklist write. The administrator delete function removes the token record from the primary store but does not add the JTI to the revocation blacklist consulted during authentication.

Attack Vector

An attacker first obtains a never-expire access token through phishing, client-side theft, log exposure, or credential compromise. The attacker then presents the token to the Ech0 API. Even if the legitimate user logs out, an administrator deletes the token, or a revocation call is issued, the JWT continues to authenticate because no blacklist entry exists. The token remains valid until the operator rotates the JWT secret. Refer to the GitHub Security Advisory and the VulnCheck Advisory for advisory-level details.

Detection Methods for CVE-2026-79664

Indicators of Compromise

Authenticated API requests bearing a JTI that appears in administrator deletion audit logs.
Successful authentication using tokens whose associated user session was terminated via logout.
Server logs showing panics or 500 responses originating from the logout handler when nil ExpiresAt is dereferenced.
Long-lived sessions from a single JTI spanning weeks or months without reissuance.

Detection Strategies

Correlate token issuance events with authentication events and flag any JTI used after a corresponding revoke, logout, or admin-delete action.
Alert on Ech0 tokens whose decoded payload lacks an exp claim or contains an unusually distant expiration.
Monitor authentication endpoints for reuse of the same JTI across geographically distinct source IP addresses.

Monitoring Recommendations

Enable verbose audit logging on token issuance, revocation, and administrator delete actions in Ech0.
Forward Ech0 application logs and JWT metadata to a centralized analytics platform for retention and correlation.
Establish a baseline for typical token lifetimes and alert on outliers that indicate never-expire issuance.

How to Mitigate CVE-2026-79664

Immediate Actions Required

Upgrade Ech0 to version 4.7.3 or later on every deployed instance.
Rotate the JWT signing secret to invalidate all previously issued never-expire tokens.
Audit existing tokens and revoke any issued with the never-expire option.
Force re-authentication for all users after the secret rotation.

Patch Information

The maintainers fixed the three revocation paths in Ech0 4.7.3. Users should upgrade directly from the project repository and consult the GitHub Security Advisory GHSA-fpw6-hrg5-q5x5 for the full remediation notes.

Workarounds

Disable issuance of never-expire tokens and require finite exp claims on all JWTs.
Rotate the JWT signing secret on a scheduled interval until upgrade is complete.
Restrict administrative token issuance to trusted operators and network segments.

bash

# Configuration example: rotate the JWT secret and restart Ech0
# 1. Generate a new 32-byte secret
openssl rand -base64 32 > /etc/ech0/jwt.secret.new

# 2. Replace the active secret and restart the service
mv /etc/ech0/jwt.secret.new /etc/ech0/jwt.secret
systemctl restart ech0

# 3. Verify version is 4.7.3 or later
ech0 --version