CVE-2026-55834
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services.
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601
- Source
- security-advisories@github.com
References
- https://github.com/pocket-id/pocket-id/commit/8a7577497131229badb35cb4b3a4227b1300afff
- https://github.com/pocket-id/pocket-id/releases/tag/v2.9.0
- https://github.com/pocket-id/pocket-id/security/advisories/GHSA-2wvm-8mvp-22qv
- https://github.com/pocket-id/pocket-id/security/advisories/GHSA-2wvm-8mvp-22qv
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.