Ech0 CVE-2026-79664

The specific precondition is that a token was created with Ech0's 'never expire' (NEVER_EXPIRY / expiry=0) option AND that token has been leaked to or stolen by the attacker - this is the AT:P attack requirement in the CVSS vector. The attacker needs no credentials of their own (PR:N) and no user interaction (UI:N), and the token works remotely over the network (AV:N). What LIMITS exploitation: only never-expire tokens are vulnerable (default/normal tokens with an exp claim are properly revoked), and the attacker must first obtain such a token out-of-band, which raises complexity (AC:H). Neither logout, admin token deletion, nor RevokeToken will stop a valid stolen never-expire token; the only condition that ends access is rotation of the JWT signing secret.

Signals are mixed and require judgment. The published CVSS 4.0 base score is 9.1 (critical) with VC:H/VI:H, reflecting the severe confidentiality and integrity consequence of perpetual authenticated access, but the vector itself tempers likelihood with AC:H and AT:P - exploitation is not turnkey. Crucially, the vulnerability is a post-compromise persistence/failure-to-revoke issue: an attacker must FIRST obtain a valid never-expire token (theft, logging, backup exposure, or a separate leak), which is the real gating condition rather than a network-reachable memory-corruption bug. There is no CISA KEV entry and no POC in the supplied data, and no EPSS score was provided, so exploitation-probability signals are absent - this reads as a serious latent-risk/hardening issue rather than a mass-exploited remote flaw. The defensive priority is nonetheless high for any operator who has issued never-expire tokens, because the impact is total and long-lived and normal revocation gives a false sense of safety (logout appears to fail with a 500, and admin deletion silently leaves the token usable). Missing data to flag: the description states 'Ech0 before 4.7.3' while the Go package metadata lists the fix as pseudo-version 1.4.8-0.20260503041146-eab62379c795 - verify the correct release tag with the vendor advisory before remediating.

An attacker obtains a valid Ech0 access token that was created with the 'never expire' option - for example harvested from browser storage, a proxy log, a leaked backup, or a compromised client. Because the token has no exp claim and every revocation path fails, the victim's logout and even the admin's 'Delete token' action do not stop it, so the attacker replays the token against the API and retains full authenticated access indefinitely. No public POC is referenced, but the failure modes are precisely documented in the GHSA advisory with exact file and line references.