Echo versions prior to v4.16.1 and v5.4.1 contain a vulnerability where rejected WebSocket upgrade requests can bypass route-level access controls. This occurs because Echo's proxy middleware forwards subsequent HTTP requests on a connection with a rejected upgrade directly to the upstream without passing through Echo's router or middleware, potentially bypassing authentication or authorization enforced at Echo routes. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. Fixed in versions v4.16.1 and v5.4.1.