Read the docs
TI-2026-32027 Aliases CVE-2026-43983GHSA-w6p7-2fxx-4f44

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

Priority HIGH 72CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function (oidc_service.go) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows (1) the client to refresh the token indefinitely after authorization revocation, (2) the refresh token to continue to work after the account is disabled, and (3) the token to work after the client is removed from the group. This vulnerability is fixed in 2.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pocket-id (pocket-id): 2.6.0github.com/pocket-id/pocket-id/backend (Go): 0.0.0-20260419162744-978ac87deffe

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pocket-idpocket-idbefore 2.6.02.6.0Patch availableCNA
—github.com/pocket-id/pocket-id/backend (Go)before 0.0.0-20260419162744-978ac87deffe0.0.0-20260419162744-978ac87deffePatch availableGHSA-w6p7-2fxx-4f44
  • pocket-id Vendorpocket-id Affected before 2.6.0 Fixed in 2.6.0 Patch available CNA
  • github.com/pocket-id/pocket-id/backend (Go) Vendor— Affected before 0.0.0-20260419162744-978ac87deffe Fixed in 0.0.0-20260419162744-978ac87deffe Patch available GHSA-w6p7-2fxx-4f44

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:*before 2.6.0Vulnerablepocket-id
  • cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:* Versions before 2.6.0 Vulnerable ·pocket-id

Remediation

  • Fix · CNA pocket-id (pocket-id) Fixed in 2.6.0
  • Fix · GHSA-w6p7-2fxx-4f44 github.com/pocket-id/pocket-id/backend (Go) Fixed in 0.0.0-20260419162744-978ac87deffe Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43983
  2. 2026-10-03 Alias added: GHSA-w6p7-2fxx-4f44

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-22775 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange CVSS 3.1HIGH 8.5
  • TI-2026-22774 Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences