CVE-2026-28513: Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-10 · updated 2026-06-17
Weakness: CWE-863

Description

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

Affected products

pocket-id: before 2.4.0 — fixed in 2.4.0

How to fix

Upgrade to a fixed version: pocket-id 2.4.0. Check the vendor advisory for mitigations.

References

https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2
https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2

Get alerted when CVE-2026-28513 or the next vulnerability affects your stack