CVE-2026-28513

HIGH

Pocket ID < 2.4.0 - Incorrect Authorization via OIDC Token Endpoint

Title source: llm
STIX 2.1

Description

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

References (1)

Core 1
Core References

Scores

CVSS v3 8.5
EPSS 0.0026
EPSS Percentile 16.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (1)
pocket-id/pocket_id < 2.4.0
Published Mar 10, 2026
Tracked Since Mar 11, 2026