Approved changes feed: RSS · Atom
cpe:2.3:a:pocket-id:pocket-id:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pocket Id (d1a0efa7-0f92-5808-9af8-5f8ca88ecfc6) |
|---|---|
| Product | Pocket Id (41f8ab7b-6446-5d0d-b827-a4ae18d1dd1f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-43983 |
vulnerable | 2026-06-08 08:03:18.043344 |
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function (oidc_service.go) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows (1) the client to refresh the token indefinitely after authorization revocation, (2) the refresh token to continue to work after the account is disabled, and (3) the token to work after the client is removed from the group. This vulnerability is fixed in 2.6.0.
Published: 2026-05-12T14:19:01.166Z
Updated: 2026-05-13T14:33:53.974Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28513 |
vulnerable | 2026-06-08 07:55:15.392244 |
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange
HIGH (8.5)
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.
Published: 2026-03-09T22:19:30.000Z
Updated: 2026-03-10T14:32:17.637Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28512 |
vulnerable | 2026-06-08 07:55:15.390883 |
Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion
HIGH (7.1)
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.
Published: 2026-03-09T22:17:58.425Z
Updated: 2026-03-10T14:32:52.265Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.