Pocket ID CVE-2026-43983

Attacker must first obtain a valid refresh token through legitimate or compromised authentication to Pocket ID, requiring low-privilege user credentials and user interaction (CVSS PR:L/UI:P). Once obtained, the refresh token remains exploitable across three specific administrative actions that should but fail to invalidate it: (1) explicit authorization revocation of the client application, (2) account disablement of the user, and (3) removal of the user from authorized groups. Exploitation occurs during the OIDC refresh token exchange flow when the createTokenFromRefreshToken function is invoked. No additional network restrictions, firewall bypass, or configuration changes are required - default Pocket ID deployments with OIDC enabled are vulnerable. The user interaction requirement limits fully automated exploitation but does not prevent persistent access once the initial token is acquired. Attack surface limited to Pocket ID instances version 2.5.x and earlier serving as OIDC providers.

Real-world risk is HIGH for organizations using Pocket ID for access control. CVSS 8.5 (network vector, low complexity, low privileges required but user interaction needed) accurately reflects exploitability - an attacker must first obtain a valid refresh token, likely through social engineering or initial compromised access. However, the CVSS vector indicates user interaction (UI:P), which may limit automated exploitation but does not prevent determined attackers. Publicly available exploit code (GitHub advisory GHSA-w6p7-2fxx-4f44) lowers the technical barrier significantly. The vulnerability's persistence across three critical security boundaries (revocation, account disablement, group removal) means standard incident response procedures (revoke access, disable account) DO NOT mitigate ongoing compromise. EPSS and KEV data not provided, but GitHub-reported POC suggests proof-of-concept exploitation is straightforward. SSVC assessment: exploitation public, automatable after initial token acquisition, high technical impact (confidentiality and integrity compromise per CVSS VC:H/VI:H). Organizations relying on Pocket ID for authorization decisions face material risk of privilege persistence attacks.

An attacker socially engineers a user to authenticate via Pocket ID and captures the initial refresh token through compromised client application or network interception. When the security team detects the compromise and revokes the user's access, disables their account, or removes them from authorized groups, the attacker continues using the captured refresh token to obtain fresh access tokens indefinitely. The OIDC service validates only the refresh token's cryptographic signature without checking the user's current authorization state, granting new access tokens that bypass all administrative revocation actions. Publicly available exploit code (GHSA-w6p7-2fxx-4f44) demonstrates the token exchange process.