Skip to content
OpenAdvisories

Package · Go

github.com/lin-snow/Ech0

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.6
    CVE-2026-79667

    Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

    Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and aut…

    lin-snow Ech0 github.com/lin-snow/Ech0 Go
  • High 7.4
    CVE-2026-79664

    Ech0 before 4.7.3 Access Token Revocation Bypass

    Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, Rev…

    lin-snow Ech0 github.com/lin-snow/Ech0 Go
  • High 8.0
    CVE-2026-79662

    Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass

    Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ign…

    lin-snow Ech0 github.com/lin-snow/Ech0 Go
  • High 7.7
    CVE-2026-79659

    Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo

    Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access in…

    lin-snow Ech0 github.com/lin-snow/Ech0 Go
  • High —
    GHSA-mqxv-9rm6-w8qc

    Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

    ### Summary Ech0's i18n middleware runs on every HTTP request and constructs a fresh `*goi18n.Localizer` from the raw `Accept-Language` header without imposing any size or shape filter. `goi18n.NewLocalizer` calls `golang.org/x/text/language.ParseAcceptLangua…

    github.com/lin-snow/Ech0 Go
  • High 7.2
    CVE-2026-35037 Public exploit

    Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

    Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validati…

    lin-snow Ech0 github.com/lin-snow/Ech0 Go
  • High 7.5
    CVE-2026-35036

    Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature

    Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe…

    lin-snow Ech0 github.com/lin-snow/Ech0 Go