Cloudanix VulnDB

GHSA-fpw6-hrg5-q5x5

High · 7.4

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

CVSS

7.4

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

Access tokens created with the "never expire" option have no `exp` JWT claim. Three independent revocation mechanisms fail for this token type. Logout at `internal/handler/auth/auth.go:154` and `:163` dereferences `claims.ExpiresAt.Time`, panicking on the nil field so the token never hits the blacklist. `RevokeToken` at `internal/repository/auth/auth.go:45-50` skips when `remainTTL <= 0`. The admin's "Delete token" panel action at `internal/service/setting/access_token_service.go:183-185` removes the database record but does not call `RevokeToken` to blacklist the JTI. Once a never-expire token leaks, the JWT stays cryptographically valid until the admin rotates the signing key across the entire instance.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities