Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-79662: Ech0 up to 4.7.2 can redirect users to attacker sites
CVE-2026-79662 · published 2 months ago
Summary
The Ech0 application (versions before 4.7.3) does not fully check the web address it sends users to after login. An attacker could craft a login link that looks safe but then sends the user to a malicious page where authentication codes can be stolen. Update Ech0 to version 4.7.3 or later to fix the check.
What to do
- Update github.com lin-snow to version 1.4.8-0.20260503040728-a7e8b8e84bd1.
- Update lin-snow ech0 to version 4.7.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | lin-snow |
< 1.4.8-0.20260503040728-a7e8b8e84bd1 Fix: upgrade to 1.4.8-0.20260503040728-a7e8b8e84bd1
|
| – | lin-snow | ech0 | < 4.7.3 |
Original advisory text
Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query, and fragment components. The redirect_uri is embedded into the signed state JWT at login time without validation. An attacker can craft a redirect_uri whose host matches an allowed origin but whose path is attacker-influenced; after the OAuth exchange the victim is redirected to that path with a one-time exchange code in the query string. If the code leaks (e.g., via Referer, analytics, or an open redirect on that host), the attacker can trade it at the public POST /api/auth/exchange endpoint for the victim's access and refresh tokens. Fixed in 4.7.3.
References
- https://github.com/lin-snow/Ech0/commit/a7e8b8e84bd1e3db090dfb720f2c6c433356b442
- https://github.com/advisories/GHSA-p64j-f4x9-wq66
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79662... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-79662 Vendor Advisory
- https://www.vulncheck.com/advisories/ech0-before-oauth-redirect-uri-validation-b... Vendor Advisory
- https://github.com/lin-snow/Ech0/security/advisories/GHSA-p64j-f4x9-wq66 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-601Open Redirect
CWE-1173Improper Use of Validation Framework
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen7 May 2026
Track software like this
Free during beta