CVE-2026-55834

Received Received - Intake

Open Redirect in Pocket ID OIDC Provider

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55834

EUVD

EUVD-2026-67828

Affected Vendors & Products

Vendor	Product	Version / Range
pocket-id	pocket-id	From 2.6.0 (inc) to 2.9.0 (exc)
pocket-id	pocket-id	2.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

Pocket ID versions 2.6.0 to 2.9.0 have an OpenID Connect (OIDC) vulnerability where the redirect_uri parameter is improperly handled. The frontend code reads this parameter and uses it in error redirects without proper validation. An attacker with a valid client_id can redirect users to arbitrary HTTP or HTTPS origins, enabling phishing attacks or OIDC error and state smuggling.

Detection Guidance

Check if your Pocket ID version is between 2.6.0 and 2.9.0 by running: grep -r "version" package.json or npm list pocket-id. Inspect frontend/src/routes/authorize/+page.ts and +page.svelte for redirect_uri handling and callbackURL usage without backend validation.

Impact Analysis

If you use Pocket ID versions 2.6.0 to 2.9.0, an attacker could trick you into visiting a malicious site via a phishing link. This could lead to stolen credentials, session hijacking, or unauthorized access to your accounts if you interact with the fake page.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected versions may face compliance risks due to potential exposure of user data or authentication credentials.

Mitigation Strategies

Upgrade Pocket ID to version 2.9.0 or later immediately. If upgrading is not possible, disable the affected routes or implement backend validation for redirect_uri and callbackURL to block non-whitelisted origins.

Hi! I’m here to help you understand CVE-2026-55834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70