CVE-2026-28512 Details
Description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.
A callback URL validation bypass vulnerability has been identified in Pocket ID, an OpenID Connect (OIDC) provider, in versions 2.0.0 prior to 2.4.0. The flaw allows crafted redirect_uri values containing URL userinfo (represented by '@') to bypass legitimate callback pattern checks. This could enable an attacker to redirect an authorization code to an attacker-controlled host, provided they can trick a user into opening a malicious authorization link.
Users can update to Pocket ID version 2.4.0, where this vulnerability has been fixed. For those unable to update, it is recommended to reject callback URLs containing userinfo '@' at the reverse proxy or application policy level, if feasible.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pocket-id/pocket-id/commit/3a339e33191c31b68bf57db907f800d9de5ffbc8 | [email protected] | Patch |
| https://github.com/pocket-id/pocket-id/security/advisories/GHSA-9h33-g3ww-mqff | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pocket-id pocket id | >= 2.0.0, < 2.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |