What is the CVSS score of CVE-2026-28513?

CVE-2026-28513 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Pocket Id are affected by CVE-2026-28513?

Pocket ID versions up to 2.4.0 contain a critical authorization bypass vulnerability that could allow attackers to gain unauthorized access to user accounts and integrated services.. A patch is available.

Is there a public PoC exploit available for CVE-2026-28513?

Yes, a public proof-of-concept exploit is available for CVE-2026-28513. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-28513?

Within 24 hours: Inventory all systems running Pocket ID and assess exposure scope; notify dependent service owners and users of potential compromise. Within 7 days: Implement network segmentation to restrict Pocket ID access, enable enhanced logging/monitoring, and contact Pocket ID vendor for patch timeline. Within 30 days: Deploy patched version immediately upon release or migrate to alternative OIDC provider if patch timeline is unacceptable.

Pocket Id CVE-2026-28513

HIGH

Incorrect Authorization (CWE-863)

2026-03-10 security-advisories@github.com

GHSA-qh6q-598w-w6m2

Authentication Bypass Pocket Id Suse

8.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 13, 2026 - 15:52 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:38 nvd

HIGH 8.5

DescriptionGitHub Advisory

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

AnalysisAI

Pocket ID versions prior to 2.4.0 fail to properly validate authorization codes at the OIDC token endpoint, enabling attackers with valid credentials to exchange codes across different clients or reuse expired codes. This authentication bypass affects any service relying on Pocket ID for passkey-based authentication and allows token acquisition without proper authorization. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain authorization code from victim client

Exploit

Submit code to different client application

Execution

Exchange code at token endpoint

Impact

Receive valid OIDC token for different client

Access

Obtain authorization code from victim client

Exploit

Submit code to different client application

Execution

Exchange code at token endpoint

Impact

Receive valid OIDC token for different client

Vulnerability AssessmentAI

Exploitation	Pocket ID OIDC provider versions before 2.4.0 with multiple registered client applications. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 8.5 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to authenticate with their passkeys to your services.
Remediation	Fixed in version 2.4.0.. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all systems running Pocket ID and assess exposure scope; notify dependent service owners and users of potential compromise. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: High

CVE-2026-28513 vulnerability details – vuln.today

Back

Pocket Id CVE-2026-28513

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code