CVE-2026-55834: medium-severity vulnerability in pocket-id
Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.4%
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
pocket-id · pocket-idRelated CVEs — pocket-id
In the same product, most dangerous first.
CVE-2026-28513HIGHPocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchangeEPSS 0.3%CVE-2026-43983HIGHPocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsEPSS 0.2%CVE-2026-28512HIGHPocket ID: OAuth redirect_uri validation bypass via userinfo/host confusionEPSS 0.2%