Skip to content
Threat Feed
Subscribe

Vendor

Lin-Snow

2 briefs RSS
high advisory

Authorization Bypass Vulnerability in Ech0

Ech0 versions prior to 4.5.1 are vulnerable to an authorization bypass in the RequireScopes middleware, allowing non-admin users to access sensitive administrative functions.

PoC Ech0 authorization-bypass web-application cve-2026-79665
1r 1t 1c
high advisory

Ech0 'Never Expire' Access Tokens Cannot Be Revoked

Ech0's access tokens with the 'never expire' option cannot be revoked through logout or deletion, leading to persistent access until the JWT secret is rotated instance-wide.

Ech0 credential-access token-revocation web-application
2r 1t