CVE-2026-71206 PUBLISHED

shiori: JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

Assigner: TuranSec
Reserved: 05.08.2026 Published: 05.08.2026 Updated: 05.08.2026

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account — a deleted or demoted owner's token continues authenticating with its original owner-level privileges until natural expiry, which can be up to 30 days with 'remember me' enabled.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS Score: 8.2

Product Status

Vendor go-shiori
Product shiori
Versions Default: unknown
  • Version 0 is affected

Credits

  • Eldor Nabijonov finder

References

Problem Types

  • CWE-613 Insufficient Session Expiration CWE