CyberRota Analysis
AI-GeneratedThe vulnerability lies in Shiori's CheckToken function, which inadequately validates JWTs by only checking the HMAC signature and failing to refresh the associated account data from the database. This oversight allows tokens of deleted or demoted accounts to retain their original privileges, potentially enabling unauthorized access for up to 30 days. Organizations utilizing this authentication mechanism should prioritize remediation to prevent potential exploitation of this flaw.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.