GHSA-FPW6-HRG5-Q5X5: Irrevocable Access Tokens and Nil-Pointer Dereference in Ech0

Vulnerability ID: GHSA-FPW6-HRG5-Q5X5

CVSS Score: 7.4

Published: 2026-05-07

Ech0 access tokens created with the 'never expire' option generate JSON Web Tokens (JWT) missing the 'exp' claim. This structural omission causes a nil-pointer dereference during logout and prevents the JTI blacklisting mechanism from functioning. Consequently, leaked access tokens cannot be revoked by administrators.

TL;DR

A missing expiration claim in Ech0's 'never expire' JWTs causes panics and silently breaks token revocation, allowing attackers to maintain perpetual access with stolen tokens.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-613, CWE-476, CWE-300

Attack Vector : Network

CVSS Score : 7.4

Impact : Persistent Authorization Bypass

Exploit Status : Proof of Concept

Component : JWT Handler & Authentication Repository

Affected Systems

Ech0 (all versions prior to commit eab62379)

Ech0 : < 1.4.8 (Fixed in: 1.4.8…