Ech0 versions earlier than 4.7.3 contain a flaw that prevents tokens issued with the never‑expire option from being properly invalidated. The application attempts to logout, revoke, or delete such tokens but the logic fails—logout triggers a panic when ExpiresAt is nil, the RevokeToken function skips tokens with a remaining TTL of zero, and an admin delete does not blacklist the token’s identifier. As a result, a stolen or guessed JWT remains cryptographically valid indefinitely, letting an attacker maintain authenticated access to the system after the token’s intended lifetime.

The affected product is the Ech0 web platform from the vendor lin‑snow. Any deployment running Ech0 version 4.7.2 or earlier is vulnerable to this access‑token revocation bypass. No later releases are affected because the flaw was fixed in version 4.7.3.

The base CVSS score of 9.1 indicates a critical impact on confidentiality, integrity, and availability. The EPSS score is not available, so the current probability of exploitation cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. However, an attacker who has obtained or guessed a valid JWT (through phishing, replay, or credential theft) can simply use that token forever, obviating the need for further exploitation. Once a token is stolen, it can be reused at will, providing a high‑value persistence vector that can be abused for prolonged clandestine access.