CVE-2026-28513

Published: Mar 10, 2026Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

Affected (1)

Products: Pocket Id: Pocket Id

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pocket Id Pocket Id	Before 2.4.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.