Read the docs
TI-2026-22774 Aliases CVE-2026-28512GHSA-9h33-g3ww-mqff

Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion

Priority LOW 31CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00246 16th percentileScored 2026-11-07
Fix Fixed pocket-id (pocket-id): 2.4.0github.com/pocket-id/pocket-id/backend (Go): 0.0.0-20260228130835-3a339e33191c

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pocket-idpocket-id2.0.0 to before 2.4.02.4.0Patch availableCNA
—github.com/pocket-id/pocket-id/backend (Go)before 0.0.0-20260228130835-3a339e33191c0.0.0-20260228130835-3a339e33191cPatch availableGHSA-9h33-g3ww-mqff
  • pocket-id Vendorpocket-id Affected 2.0.0 to before 2.4.0 Fixed in 2.4.0 Patch available CNA
  • github.com/pocket-id/pocket-id/backend (Go) Vendor— Affected before 0.0.0-20260228130835-3a339e33191c Fixed in 0.0.0-20260228130835-3a339e33191c Patch available GHSA-9h33-g3ww-mqff

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:*2.0.0 to before 2.4.0Vulnerablepocket-id
  • cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.4.0 Vulnerable ·pocket-id

Remediation

  • Fix · CNA pocket-id (pocket-id) Fixed in 2.4.0
  • Fix · GHSA-9h33-g3ww-mqff github.com/pocket-id/pocket-id/backend (Go) Fixed in 0.0.0-20260228130835-3a339e33191c Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28512
  2. 2026-10-03 Alias added: GHSA-9h33-g3ww-mqff

References

Patch 2

Advisory 1

Other 1

  • TI-2026-32027 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions CVSS 4.0HIGH 8.5
  • TI-2026-22775 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange CVSS 3.1HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences