High severity8.3NVD Advisory· Published Aug 5, 2026· Updated Aug 26, 2026
CVE-2026-71206
CVE-2026-71206
Description
Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.