Read the docs
TI-2026-40301 Aliases CVE-2026-55834GHSA-2wvm-8mvp-22qv

Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Priority MEDIUM 53CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00373 31st percentileScored 2026-11-07
Fix Fixed pocket-id (pocket-id): 2.9.0github.com/pocket-id/pocket-id/backend (Go): 2.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pocket-idpocket-id2.6.0 to before 2.9.02.9.0Patch availableCNA
—github.com/pocket-id/pocket-id/backend (Go)2.6.0 to before 2.9.02.9.0Patch availableGHSA-2wvm-8mvp-22qv
  • pocket-id Vendorpocket-id Affected 2.6.0 to before 2.9.0 Fixed in 2.9.0 Patch available CNA
  • github.com/pocket-id/pocket-id/backend (Go) Vendor— Affected 2.6.0 to before 2.9.0 Fixed in 2.9.0 Patch available GHSA-2wvm-8mvp-22qv

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:*——pocket-id
  • cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:* Versions — — ·pocket-id

Remediation

  • Fix · CNA pocket-id (pocket-id) Fixed in 2.9.0
  • Fix · GHSA-2wvm-8mvp-22qv github.com/pocket-id/pocket-id/backend (Go) Fixed in 2.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55834
  2. 2026-10-03 Alias added: GHSA-2wvm-8mvp-22qv

References

Other 4

  • TI-2026-32027 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions CVSS 4.0HIGH 8.5
  • TI-2026-22775 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange CVSS 3.1HIGH 8.5
  • TI-2026-85259 Pocket ID email verification token survives address change CVSS 3.1CRITICAL 9.6
  • TI-2026-85256 Missing audience validation in Pocket ID client credentials grant CVSS 3.0HIGH 7.7
  • TI-2026-22774 Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences