PkgSeer

Vulnerability GO-2026-6119

Unknown

2 months ago

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend

<0.0.0-20260419162744-978ac87deffe

Summary

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend

Details

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

<0.0.0-20260727180059-43aaccd5bfac GHSA-rm8c-2cv8-jwf6

Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences

<0.0.0-20260622164202-8158452b3730 GHSA-q4xm-p75h-h9p3

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none in github.com/pocket-id/pocket-id/backend

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

>=2.6.0 <2.9.0 GHSA-2wvm-8mvp-22qv

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method in github.com/pocket-id/pocket-id/backend

<0.0.0-20260419162744-978ac87deffe GO-2026-6117

View all vulnerabilities for these packages

Impacted packages

github.com/pocket-id/pocket-id/backend

Timeline

Published

2 months ago

Fixed (v0.0.0-20260419162744-978ac87deffe)

6 months ago

Last Modified

2 months ago