Vulnerabilities in pocket-id
6 resultsCVE-2026-55834MEDIUMPocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=noneEPSS 0.4%CVE-2026-28513HIGHPocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchangeEPSS 0.3%CVE-2026-62662HIGHPocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiencesEPSS 0.3%CVE-2026-43983HIGHPocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsEPSS 0.2%CVE-2026-28512HIGHPocket ID: OAuth redirect_uri validation bypass via userinfo/host confusionEPSS 0.2%CVE-2026-115770CRITICALPocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofingEPSS 0.2%