CVE-2026-71206

20th percentile - higher than 20% of all known CVEs

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.

Stolen or expired JWT tokens remain valid until their expiration time, allowing an attacker to maintain access to an account even after password changes or user deletion.

Implement re-fetching of the account from the database during token validation and add a token revocation mechanism (e.g., denylist) and session store.