Nixpkgs Security Tracker

Login with GitHub

Suggestions search

Published
Filter by:
With package: pocket-id

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-28513
8.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 1 week, 4 days ago by @mweinelt Activity log
  • Created automatic suggestion 1 week, 5 days ago
  • @mweinelt accepted 1 week, 4 days ago
  • @mweinelt published on GitHub 1 week, 4 days ago
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

References

Affected products

pocket-id
  • ==< 2.4.0

Matching in nixpkgs

Package maintainers

https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2

NixOS Unstable: https://github.com/NixOS/nixpkgs/pull/497928
NixOS 25.11: Unfixed