Vulnerabilities

TI-2026-32027 CVE-2026-43983 · GHSA-w6p7-2fxx-4f44

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

HIGH 72

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00247 Published 2026-05-12 Fixed in 2.6.0, 0.0.0-20260419162744-978ac87deffe CWE-285

TI-2026-22775 CVE-2026-28513 · GHSA-qh6q-598w-w6m2

HIGH 70

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00308 Published 2026-03-09 Fixed in 2.4.0, 0.0.0-20260307173642-b59e35cb59ae CWE-863

TI-2026-22774 CVE-2026-28512 · GHSA-9h33-g3ww-mqff

LOW 31

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00246 Published 2026-03-09 Fixed in 2.4.0, 0.0.0-20260228130835-3a339e33191c CWE-601