The vulnerability in go-shiori's shiori involves the CheckToken function (internal/domains/auth.go) which validates JWT tokens solely by checking the HMAC signature and then returns the embedded claims.Account object without revalidating the account status from the database. This design lacks a session store or token revocation mechanism, resulting in insufficient session expiration (CWE-613). This flaw could allow attackers to use tokens beyond their intended lifetime or after account changes, potentially leading to unauthorized access. The CVSS 3.1 score is 8.2 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity, with low impact on availability.

The vulnerability allows an attacker with a valid JWT token to maintain access beyond the intended session lifetime because tokens are not revoked or revalidated against the current account state. This can lead to unauthorized access to sensitive information (high confidentiality impact) and unauthorized actions (high integrity impact). Availability impact is low. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing additional session management controls externally, such as token expiration enforcement and revocation mechanisms. Monitoring for unusual token usage patterns may help detect exploitation attempts.