Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M
CVE-2026-28512Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion
High 7.1
In plain English
A high-severity open redirect in pocket-id from pocket-id. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/pocket-id/pocket-id/backend | 0.0.0-20260228130835-3a339e33191c | GHSA-9h33-g3ww-mqff |
| Go | github.com/pocket-id/pocket-id/backend | 0.0.0-20260228130835-3a339e33191c | GO-2026-4653 |
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N