CVE-2026-71206

8.3 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows attackers to manipulate JWT tokens and gain unauthorized access to user accounts without revalidating them from the database.
Exploitability: Exploitation requires knowledge of JWT token manipulation but does not need user interaction or elevated privileges.
Blast radius: If exploited, it could lead to full account takeover for affected users, compromising sensitive data and potentially the entire application's security.
Prioritized remediation: Implement proper account validation by re-fetching the account from the database before using claims.Account object.

auth-bypassjwtsecurity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weaknesses

CWE-613

Public exploit & PoC references

https://github.com/go-shiori/shiori

All references

https://github.com/go-shiori/shiori

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.