Pocket Id
CVE-2026-28513
HIGH
GHSA-qh6q-598w-w6m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authorization code from victim client
-
ExploitSubmit code to different client application
-
ExecutionExchange code at token endpoint
-
ImpactReceive valid OIDC token for different client
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Pocket ID OIDC provider versions before 2.4.0 with multiple registered client applications. Attacker requires valid login credentials (PR:L) to obtain initial authorization code from one client, then exploits flawed token endpoint validation logic that accepts codes across different clients. |
| Impact | CVSS 8.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to authenticate with their passkeys to your services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Pocket ID versions prior to 2.4.0 fail to properly validate authorization codes at the OIDC token endpoint, enabling attackers with valid credentials to exchange codes across different clients or reuse expired codes. This authentication bypass affects any service relying on Pocket ID for passkey-based authentication and allows token acquisition without proper authorization. Public exploit code exists for this vulnerability, and no patch is currently available.
Earlier versions of this analysis (1)
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. versions up to 2.4.0 is affected by incorrect authorization (CVSS 8.5).
RemediationAI
Fixed in version 2.4.0.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-863: Incorrect Authorization) affects Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.. Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.
Know when Pocket Id gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.
Executive ViewAI
Pocket ID versions up to 2.4.0 contain a critical authorization bypass vulnerability that could allow attackers to gain unauthorized access to user accounts and integrated services. This affects any organization using Pocket ID for authentication, potentially compromising customer identities and the security of dependent applications.
Implement WAF rules to block suspicious authorization requests; restrict Pocket ID instance access to trusted networks only; disable Pocket ID authentication temporarily if risk tolerance is low and migrate users to alternative OIDC provider; enable comprehensive audit logging and real-time alerting on authentication failures; require multi-factor authentication on all dependent services as additional verification layer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB