CVE-2026-71206 Details
Description
Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.
A vulnerability exists in Shiori's authentication token management. The CheckToken function in internal/domains/auth.go only verifies the HMAC signature of JSON Web Tokens (JWTs) and returns the claims.Account object without refreshing the account status from the database. There is no session storage or token revocation system implemented. As a result, if an account is deleted or its role is downgraded from owner to regular, the corresponding JWT remains valid with owner privileges until it naturally expires, which can take up to 30 days if 'remember me' is activated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-shiori/shiori | TuranSec | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| go-shiori Shiori | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |