Skip to content
OpenAdvisories

Package · Go

github.com/pocket-id/pocket-id/backend

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-55834

    Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

    Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw …

    pocket-id pocket-id github.com/pocket-id/pocket-id/backend Go
  • Medium —
    GHSA-hp74-gm6m-2qm5

    Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

    # Reauthentication Bypass via One-Time Access Token Login ## Summary A weaker authentication method (OTA token or signup token) is accepted as passkey step-up proof, yielding unauthorized renewable 30-day OIDC refresh tokens for clients explicitly configured …

    github.com/pocket-id/pocket-id/backend Go