CVE-2026-28513 - Vulnerability Analysis

Overview

Pocket ID < 2.4.0 contains a broken authentication caused by improper validation of authorization code and client ID in the OIDC token endpoint, letting attackers perform cross-client code exchange and reuse expired codes, exploit requires crafted authorization requests.

Severity & Score

Impact

Attackers can reuse expired authorization codes and exchange codes across clients, potentially leading to unauthorized access.

Mitigation

Update to version 2.4.0 or later.

References

• https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner