What is the CVSS score of CVE-2026-28513?

CVE-2026-28513 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Pocket Id are affected by CVE-2026-28513?

Pocket ID versions up to 2.4.0 contain a critical authorization bypass vulnerability that could allow attackers to gain unauthorized access to user accounts and integrated services.. A patch is available.

Is there a public PoC exploit available for CVE-2026-28513?

Yes, a public proof-of-concept exploit is available for CVE-2026-28513. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-28513?

Within 24 hours: Inventory all systems running Pocket ID and assess exposure scope; notify dependent service owners and users of potential compromise. Within 7 days: Implement network segmentation to restrict Pocket ID access, enable enhanced logging/monitoring, and contact Pocket ID vendor for patch timeline. Within 30 days: Deploy patched version immediately upon release or migrate to alternative OIDC provider if patch timeline is unacceptable.

Pocket Id CVE-2026-28513

HIGH

Incorrect Authorization (CWE-863)

2026-03-10 security-advisories@github.com

GHSA-qh6q-598w-w6m2

Authentication Bypass Pocket Id Suse

8.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 13, 2026 - 15:52 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:38 nvd

HIGH 8.5

DescriptionGitHub Advisory

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

AnalysisAI

Pocket ID versions prior to 2.4.0 fail to properly validate authorization codes at the OIDC token endpoint, enabling attackers with valid credentials to exchange codes across different clients or reuse expired codes. This authentication bypass affects any service relying on Pocket ID for passkey-based authentication and allows token acquisition without proper authorization. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

This vulnerability (CWE-863: Incorrect Authorization) affects Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.. Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.