CyberRota Analysis
AI-GeneratedEch0 versions prior to 4.7.3 are vulnerable due to inadequate revocation of access tokens created with a never-expire option, which allows attackers to retain authenticated access even after token theft. The failure of multiple revocation mechanisms means that stolen tokens remain valid until the JWT secret is rotated, posing a significant security risk. Organizations using affected versions should prioritize upgrading to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.