Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never…

Shiori, an open-source bookmark manager, contains a critical authentication flaw in its CheckToken function located in internal/domains/auth.go. The function validates only the JWT HMAC signature and returns embedded claims without re-fetching account data from the database. No session store or token revocation mechanism exists in the codebase. As a result, deleting an account or demoting it from owner to a regular role does not invalidate previously issued tokens. A deleted or demoted owner's JWT continues to authenticate with full owner-level privileges until the token naturally expires. With 'remember me' enabled, tokens can remain valid for up to 30 days, creating a significant privilege persistence risk.