Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M

CVE-2026-28513Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

High 8.5

In plain English

A high-severity incorrect authorization in pocket-id from pocket-id. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.3%top 76.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/pocket-id/pocket-id/backend	0.0.0-20260307173642-b59e35cb59ae	GHSA-qh6q-598w-w6m2
Go	github.com/pocket-id/pocket-id/backend	0.0.0-20260307173642-b59e35cb59ae	GO-2026-4656

Affected products (as reported)

Vendor	Product	Versions
pocket-id	pocket-id	< 2.4.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2 x_refsource_CONFIRM