Pocket Id
CVE-2026-28512
HIGH
GHSA-9h33-g3ww-mqff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious authorization link with @ in redirect_uri
-
ExploitUser clicks link and authenticates
-
ExecutionAuthorization code redirected to attacker server
-
ImpactAttacker intercepts code for session hijacking
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Pocket ID versions 2.0.0 to before 2.4.0 with OIDC provider deployment. Attacker must trick user into clicking malicious authorization link containing URL userinfo (@) character in redirect_uri parameter to bypass callback validation. |
| Impact | CVSS 7.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to authenticate with their passkeys to your services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Pocket ID versions 2.0.0 through 2.3.x suffer from improper callback URL validation that allows attackers to bypass redirect URI restrictions using URL userinfo characters (@), enabling authorization code interception. An attacker can craft a malicious authorization link to redirect authentication codes to an attacker-controlled server if a user is tricked into clicking it. Public exploit code exists for this vulnerability, and no patch is currently available.
Earlier versions of this analysis (1)
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to versions up to 2.4.0 is affected by url redirection to untrusted site (open redirect) (CVSS 7.1).
RemediationAI
Fixed in version 2.4.0.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-601: URL Redirection to Untrusted Site (Open Redirect)) affects Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to. Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.
Know when Pocket Id gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.
Executive ViewAI
Pocket ID authentication systems (versions 2.0.0-2.4.0) contain an open redirect vulnerability that could allow attackers to redirect users to malicious sites during the authentication process, potentially compromising credentials or enabling phishing attacks. Organizations using affected versions risk user account compromise and reputational damage, particularly if Pocket ID is used for critical service access.
Implement Web Application Firewall (WAF) rules to validate redirect URLs against allowlist of known legitimate domains; disable Pocket ID authentication temporarily if high-risk environment; restrict Pocket ID access to internal networks only using network segmentation; monitor authentication flows for anomalous redirect patterns; implement additional user verification for sensitive operations post-authentication; consider temporary migration to alternative OIDC providers. No vendor patch currently available—monitor vendor security advisories for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB