CVE-2026-62662

Received Received - Intake

Authentication Bypass in Pocket ID OIDC Provider

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds it directly in the access token aud claim without validating that the audience is registered or that the requesting client may access it. Any authenticated OIDC client can therefore obtain a Pocket ID-signed token naming another client or an arbitrary audience. The /api/oidc/introspect endpoint cannot distinguish the unauthorized token because it treats a token as active when the introspecting client's identifier matches the attacker-selected audience. In deployments where resource servers trust Pocket ID access tokens for service-to-service authorization, this bypasses audience-based access controls and can permit unauthorized data access or actions; deployments that do not use these tokens for resource-server authorization have no immediate exploitable impact. This issue is fixed in version 2.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-62662

Affected Vendors & Products

Vendor	Product	Version / Range
pocket-id	pocket-id	>= 1.11.0, < 2.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

Pocket ID is an OIDC provider allowing passkey authentication. Between versions 1.11.0 and 2.10.0, a flaw in createTokenFromClientCredentials allows any authenticated client to embed a custom audience in an access token without validation. This enables unauthorized tokens to be created with arbitrary audience claims.

Detection Guidance

This vulnerability requires checking if your Pocket ID deployment is running a vulnerable version (1.11.0 to 2.10.0) and verifying if resource servers improperly trust tokens with arbitrary audiences. No direct detection commands are provided in the context. Review logs for unusual token introspection requests or unauthorized access patterns.

Impact Analysis

If your deployment uses Pocket ID tokens for service-to-service authorization, attackers could bypass audience-based access controls. This may allow unauthorized data access or actions. Deployments not using tokens for authorization face no immediate impact.

Compliance Impact

This vulnerability could lead to unauthorized data access or actions in deployments where Pocket ID access tokens are used for service-to-service authorization. This may violate compliance requirements under GDPR (e.g., unauthorized access to personal data) or HIPAA (e.g., unauthorized access to protected health information) if such access controls are bypassed.

Mitigation Strategies

Upgrade Pocket ID to version 2.10.0 or later to address the vulnerability.
Review and restrict access token audiences to only trusted clients or services.
Audit deployments using Pocket ID access tokens for service-to-service authorization to ensure proper audience-based access controls are enforced.

Hi! I’m here to help you understand CVE-2026-62662. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...