Vulnerability details
CVE-2026-43983
pocket-id pocket-id
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
CVSS 4.0
8.5High
Official description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function (oidc_service.go) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows (1) the client to refresh the token indefinitely after authorization revocation, (2) the refresh token to continue to work after the account is disabled, and (3) the token to work after the client is removed from the group. This vulnerability is fixed in 2.6.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.5High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| pocket-id | pocket-id | < 2.6.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44 x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-12
- Last updated
- 2026-05-13
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.24%
Probability of exploitation in 30 days
16.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-285Improper Authorization
- CWE-613Insufficient Session Expiration