pocket-id vulnerabilities
6 published CVEs name pocket-id among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 1Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-115770
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
pocket-id · pocket-id
Critical9.6 - CVE-2026-62662
Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
pocket-id · pocket-id
High7.7 - CVE-2026-55834
Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
pocket-id · pocket-id
Medium4.3 - CVE-2026-43983
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
pocket-id · pocket-id
High8.5 - CVE-2026-28513
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange
pocket-id · pocket-id
High8.5 - CVE-2026-28512
Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion
pocket-id · pocket-id
High7.1