CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
An attacker can redirect victims to malicious sites via unvalidated redirect_uri in Pocket ID's OIDC authorize flow, enabling phishing or state smuggling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55834?
CVE-2026-55834 is a medium-severity vulnerability in pocket-id, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.
Weakness: CWE-601
Which versions are affected by CVE-2026-55834?
3 open source packages ship an affected version, including github.com/pocket-id/pocket-id/backend.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pocket-id/pocket-id/backend Go | All versions | None |
github.com/pocket-id/pocket-id/backend Go | From 2.6.0 | 2.9.0 |
github.com/pocket-id/pocket-id/backend Go | From 2.6.0 | 2.9.0 |
How do I fix CVE-2026-55834?
Upgrade github.com/pocket-id/pocket-id/backend to 2.9.0 or later.
Is CVE-2026-55834 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55834 exists.
Sources
Also known as GHSA-2wvm-8mvp-22qv, GO-2026-6305.