Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.

CVE-2026-79664 affects Ech0 versions before 4.7.3, where access tokens created with the never-expire option cannot be properly revoked. Three separate revocation mechanisms all fail: the logout function panics on a nil ExpiresAt field, RevokeToken skips revocation when remainTTL is zero, and the admin delete function does not blacklist the JWT ID (JTI). As a result, stolen tokens remain cryptographically valid indefinitely unless the JWT secret is rotated. This allows attackers who obtain a never-expire token to maintain persistent authenticated access to the system. The vulnerability is classified as high severity due to the potential for perpetual unauthorized access. A fix is available in Ech0 version 4.7.3 and later.