CVE-2026-43983 Details
Description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function (oidc_service.go) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows (1) the client to refresh the token indefinitely after authorization revocation, (2) the refresh token to continue to work after the account is disabled, and (3) the token to work after the client is removed from the group. This vulnerability is fixed in 2.6.0.
A vulnerability in Pocket ID's OIDC provider allows refresh tokens to be misused after authorization has been revoked, accounts disabled, or clients removed from groups. This issue arises because the 'createTokenFromRefreshToken' function, prior to version 2.6.0, validated the refresh token's integrity but failed to check the user's current authorization status before issuing new tokens. As a result, clients could indefinitely refresh tokens after authorization revocation, disabled accounts could still use refresh tokens, and group restrictions could be bypassed.
Users should update to Pocket ID version 2.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pocket-id pocket id | < 2.6.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |