CVE-2026-28512 PUBLISHED

Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion

Assigner: GitHub_M
Reserved: 27.02.2026 Published: 09.03.2026 Updated: 09.03.2026

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS Score: 7.1

Product Status

Vendor pocket-id
Product pocket-id
Versions
  • Version >= 2.0.0, < 2.4.0 is affected

References

Problem Types

  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE