VulnerabilityAnalyzed

CVE-2026-28512

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.

MEDIUM 6.1EPSS 0.22%

Does this matter?

Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.

Description

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.22% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-601
Affected: pocket-id/pocket id
Source: security-advisories@github.com

References

https://github.com/pocket-id/pocket-id/commit/3a339e33191c31b68bf57db907f800d9de5ffbc8Patch
https://github.com/pocket-id/pocket-id/security/advisories/GHSA-9h33-g3ww-mqffMitigation, Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.