Echo EUVD-2026-112396

Exploitation requires an Echo application (v4 4.0.0-4.16.0 or v5 5.0.0-5.4.0) that uses the Proxy middleware with a client-reachable proxy route; a configured upstream that rejects the client's WebSocket upgrade with an ordinary HTTP keep-alive response WITHOUT closing the connection; and a target resource on that upstream that relies on Echo's route-level authentication/authorization and enforces no independent upstream authorization. Limiting factors: it does not provide arbitrary-host proxying and does not bypass the upstream's own authentication, and merely returning a non-101 response from the upstream is NOT a sufficient mitigation. The dependence on the upstream's rejected-upgrade behavior (the AT:P attack requirement) is the main constraint beyond attacker control.

Signals mostly align toward elevated but conditional risk. The vuln.today Decision label is act_now, and the CVSS 4.0 base score is 9.1 (AV:N/AC:L/AT:P/PR:N/UI:N, confidentiality and integrity High), reflecting an unauthenticated, network-reachable authorization bypass. However, the AT:P (attack requirement present) metric correctly captures that exploitation is not fully attacker-controlled: it depends on a cooperating upstream that rejects the WebSocket upgrade with a keep-alive (non-101) response rather than closing the connection. No EPSS score, CISA KEV listing, or SSVC-style automatable/exploitation fields were supplied in the input, so widespread-exploitation probability cannot be quantified from the data given - the act_now label here is driven by severity and the auth-bypass nature, not by confirmed in-the-wild activity. No public exploit code is referenced; the flaw was reported privately by @Duodum. Net: this is a genuine priority for anyone running Echo's Proxy middleware, but its real-world impact is gated by a specific deployment (proxy route reachable, upstream rejects upgrades without closing, and the upstream enforces no independent authorization), so it is narrower than the raw 9.1 suggests for the general Echo population.

An attacker reaches an Echo application that exposes a Proxy middleware route and sends a client WebSocket upgrade request. The configured upstream rejects the upgrade with an ordinary keep-alive HTTP response instead of closing the connection, yet Echo has already selected a raw tunnel; the attacker then sends further HTTP requests on that same connection, which are forwarded directly to the upstream without passing through Echo's router or route-level authentication/authorization middleware. No public exploit code is referenced, though the mechanism is detailed in the GHSA advisory.