CVE-2026-79664: Insufficient Session Expiration in lin-snow Ech0

CVE-2026-79664 affects Ech0 before version 4.7.3 by failing to properly revoke access tokens that are created with a never-expire option. The vulnerability arises because three independent token revocation mechanisms do not function correctly: logout triggers a panic when the ExpiresAt field is nil; the RevokeToken function skips revocation if the remaining TTL is zero; and the admin delete operation does not blacklist the token's JTI, allowing stolen tokens to remain cryptographically valid until the JWT secret is rotated. This flaw enables attackers who have stolen such tokens to maintain perpetual authenticated access.

Attackers who obtain access tokens created with the never-expire option can maintain indefinite authenticated access to the affected Ech0 system. This undermines session expiration controls and token revocation mechanisms, potentially allowing unauthorized persistent access until the JWT secret is rotated. The vulnerability has a CVSS 4.0 base score of 9.1, indicating critical severity with network attack vector, high complexity, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is null, users should monitor vendor communications for updates. Until a fix is available, avoid using the never-expire token option or rotate JWT secrets frequently to limit token validity. Do not rely on existing token revocation mechanisms as they are ineffective for this token type.