CVE-2026-28512 Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion
Attackers can bypass redirect_uri validation to steal authorization codes, potentially leading to account takeover in Pocket ID deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-28512?
CVE-2026-28512 is a high-severity vulnerability in pocket-id, published on 9 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.
Weakness: CWE-601
Which versions are affected by CVE-2026-28512?
3 open source packages ship an affected version, including github.com/pocket-id/pocket-id/backend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pocket-id/pocket-id/backend Go | All versions | 0.0.0-20260228130835-3a339e33191c |
github.com/pocket-id/pocket-id/backend Go | All versions | 0.0.0-20260228130835-3a339e33191c |
github.com/pocket-id/pocket-id/backend Go | All versions | 0.0.0-20260228130835-3a339e33191c |
Products include Pocket-Id Pocket Id.
How do I fix CVE-2026-28512?
Upgrade github.com/pocket-id/pocket-id/backend to 0.0.0-20260228130835-3a339e33191c or later.
Is CVE-2026-28512 being exploited?
There is no known exploitation of CVE-2026-28512 in the wild and no public exploit code.
Other vulnerabilities in pocket-id
Sources
Also known as GHSA-9h33-g3ww-mqff, GO-2026-4653.