CVE-2026-79664 Ech0 before 4.7.3 Access Token Revocation Bypass

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero,...

EUVD-2026-65450

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero,...

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions Summary The createTokenFromRefreshToken function oidcservice.go:451 validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before...

PT-2026-44466

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.2 Description The federated token rescoping mechanism fails to propagate the original token's expiry to the newly issued token. When a federated user rescopes a token through the 'POST /v3/auth/tokens'...

PT-2026-81283

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.7.3 Description Failure to properly revoke access tokens created with the never-expire option allows attackers to maintain perpetual authenticated access following token theft. This occurs because three revocation...