CVE-2026-28512: Pocket-Id Pocket Id

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.

Affected products

• Pocket-Id Pocket Id: from 2.0.0, before 2.4.0 (fixed in 2.4.0)

Published 2026-03-10. Last modified 2026-06-17.