Nixpkgs Security Tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: pocket-id

Found 2 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2026-28513
8.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 1 week, 3 days ago by @mweinelt Activity log
  • Created automatic suggestion 1 week, 5 days ago
  • @mweinelt accepted 1 week, 4 days ago
  • @mweinelt published on GitHub 1 week, 3 days ago
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

References

Affected products

pocket-id
  • ==< 2.4.0

Matching in nixpkgs

Package maintainers

https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2

NixOS Unstable: https://github.com/NixOS/nixpkgs/pull/497928
NixOS 25.11: Unfixed
Dismissed
Permalink CVE-2026-28512
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 1 week, 3 days ago by @mweinelt Activity log
  • Created automatic suggestion 1 week, 5 days ago
  • @mweinelt dismissed 1 week, 3 days ago
Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.

References

Affected products

pocket-id
  • ==>= 2.0.0, < 2.4.0

Matching in nixpkgs

Package maintainers

Unstable: https://github.com/NixOS/nixpkgs/pull/497928
25.11: Unaffected