Ppocket-id

Products

Exploited and recent CVEs

• CVE-2026-115770 Critical 9.6 Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing 0.2%
• CVE-2026-62662 High 7.7 Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences 0.3%
• CVE-2026-55834 Medium 4.3 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none 0.4%
• CVE-2026-43983 High 8.5 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions 0.2%
• CVE-2026-28513 High 8.5 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange 0.3%
• CVE-2026-28512 High 7.1 Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion 0.2%