Pocket-id vulnerabilities

Products

• Pocket-id 6
• Pocket Id 3

Newest

• pocket-id Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing CVE-2026-115770 9.6 CriticalNovember 4, 2026
• pocket-id Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences CVE-2026-62662 7.7 HighNovember 4, 2026
• pocket-id Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none CVE-2026-55834 Fix available 4.3 MediumAugust 28, 2026
• pocket-id pocket id, pocket-id +1 more Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions CVE-2026-43983 Fix available 8.5 HighMay 12, 2026
• pocket-id pocket id, pocket-id +1 more Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange CVE-2026-28513 Fix available 8.5 HighMarch 9, 2026
• pocket-id pocket id, pocket-id +1 more Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion CVE-2026-28512 Fix available 7.1 HighMarch 9, 2026