Which versions of Pocket ID are affected by CVE-2026-43983?

Pocket ID OIDC provider versions before 2.6.0 contain a critical authorization bypass in refresh token handling that allows revoked or disabled users to maintain indefinite access to protected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-43983?

Yes, a public proof-of-concept exploit is available for CVE-2026-43983. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-43983?

Within 24 hours: Inventory all Pocket ID OIDC provider deployments and document current versions; alert security and application teams of the authorization bypass risk. Within 7 days: Upgrade all Pocket ID instances to version 2.6.0 or later; coordinate with dependent applications to validate token validation post-upgrade. Within 30 days: Conduct audit of refresh token issuance logs to identify whether revoked users obtained tokens; review and revoke any suspicious active sessions; implement enhanced monitoring on refresh token endpoints.

Pocket ID CVE-2026-43983

Q: What is the CVSS score of CVE-2026-43983?

CVE-2026-43983 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29482 HIGH

Improper Authorization (CWE-285)

2026-05-12 GitHub_M

Authentication Bypass Pocket Id

8.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

May 12, 2026 - 16:02 EUVD

Analysis Generated

May 12, 2026 - 15:31 vuln.today

CVSS changed

May 12, 2026 - 15:22 NVD

8.5 (HIGH)

CVE Published

May 12, 2026 - 14:19 nvd

HIGH 8.5

DescriptionGitHub Advisory

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function (oidc_service.go) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows (1) the client to refresh the token indefinitely after authorization revocation, (2) the refresh token to continue to work after the account is disabled, and (3) the token to work after the client is removed from the group. This vulnerability is fixed in 2.6.0.

AnalysisAI

Pocket ID OIDC provider fails to validate user authorization state during refresh token exchange, allowing revoked, disabled, or unauthorized users to obtain fresh access tokens indefinitely. Affects all versions prior to 2.6.0. Publicly available exploit code exists via GitHub security advisory GHSA-w6p7-2fxx-4f44. Attack requires low privileges and user interaction (CVSS 8.5) but enables persistent unauthorized access even after administrative revocation actions. Fixed in version 2.6.0.

Technical ContextAI

Pocket ID implements OpenID Connect (OIDC) authentication using passkeys. The vulnerability resides in the createTokenFromRefreshToken function within oidc_service.go, which performs cryptographic validation of the refresh token's signature but omits authorization state checks. OAuth 2.0 and OIDC refresh token flows should verify current user status, group membership, and client authorization before issuing new access tokens. This is a CWE-285 (Improper Authorization) implementation flaw where cryptographic validity is conflated with authorization validity. The CPE cpe:2.3:a:pocket-id:pocket-id indicates this affects the core Pocket ID authentication service, not a specific client integration.

RemediationAI

Upgrade Pocket ID to version 2.6.0 immediately, which includes authorization state validation in the refresh token exchange flow. The patched version re-checks user account status, client authorization, and group membership before issuing new access tokens. Upgrade path documented in GitHub security advisory GHSA-w6p7-2fxx-4f44 (https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44). For environments unable to upgrade immediately, implement compensating controls: (1) Reduce refresh token lifetime to minimum operationally acceptable duration via OIDC configuration - trades security for user re-authentication frequency and potential service disruption during token expiry; (2) Monitor and revoke ALL refresh tokens when revoking user access or disabling accounts - requires manual operational process and does not prevent exploitation window between revocation and token expiry; (3) Implement application-layer authorization checks that verify user status independently of Pocket ID tokens - adds latency and duplicates authorization logic but provides defense in depth. Note that refresh token revocation alone is insufficient per the vulnerability description, requiring forced token expiration or user re-authentication.