CVE-2026-55834 in Pocket ID
Summary
by MITRE • 08/28/2026
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Pocket ID versions ranging from 2.6.0 through 2.9.0 represents a critical OpenID Connect (OIDC) authorization flow flaw rooted in improper validation of the redirect_uri parameter during silent authentication attempts. As an OIDC provider, Pocket ID facilitates user authentication via passkeys for various relying parties. The core technical deficiency lies within the frontend implementation, specifically in the files responsible for handling the authorize route and error redirection logic. When a client application requests authorization with the prompt=none parameter to perform silent background authentication, the system attempts this process without direct user interaction. If this silent attempt fails due to missing session or other constraints, the application must redirect the browser back to an error page while preserving context for the relying party. The frontend code in +page.svelte utilizes a raw callbackURL value directly within its redirectWithError function logic rather than validating it against a server-side allow-list.
This architectural oversight creates a significant security gap because the client-side validation mechanisms are insufficiently robust. Specifically, the frontend only blocks javascript and data URI schemes but fails to enforce strict domain matching or protocol restrictions for HTTP and HTTPS origins. Consequently, an unauthenticated attacker who possesses a valid client_id can craft a malicious authorization request that exploits this flaw. By manipulating the redirect_uri parameter in such requests, the attacker forces the Pocket ID instance to redirect the victim's browser to an arbitrary external origin controlled by the adversary. This behavior fundamentally violates the security expectations of the OIDC specification regarding state and error handling integrity.
The operational impact of this vulnerability is severe, primarily facilitating phishing attacks and potential data exfiltration through state smuggling. Since the attacker can dictate where the user agent is redirected after a failed silent login attempt, they can host a malicious page designed to mimic legitimate services or capture sensitive information passed in query parameters. Furthermore, because the redirect occurs without proper server-side validation of the destination origin against registered client metadata, it enables OIDC error smuggling and state parameter manipulation. Attackers may leverage this capability to steal authentication states, session tokens, or other confidential data embedded within the URL fragments or query strings during the redirection process. This undermines the trust model that relies on secure callback URIs to ensure that sensitive identity information is only returned to verified relying parties.
From a classification perspective, this vulnerability aligns with CWE-601, which describes Open Redirect vulnerabilities, and specifically relates to improper validation of redirect URLs in authentication flows. In terms of the MITRE ATT&CK framework, this behavior supports techniques associated with credential harvesting and phishing via social engineering, as well as potential exploitation for session hijacking if state parameters are compromised. The lack of server-side verification means that client-side controls alone cannot guarantee security against determined adversaries who can manipulate URL parameters before they reach the vulnerable frontend logic.
To mitigate this risk, organizations running Pocket ID must upgrade to version 2.9.0 or later where the issue has been resolved. For environments unable to immediately patch, administrators should implement strict input validation on all redirect_uri parameters at the API gateway or reverse proxy level prior to reaching the application backend. Additionally, enforcing Content Security Policy headers that restrict navigation targets and ensuring that only pre-registered callback URIs are accepted by the server-side logic can provide compensating controls. It is also advisable to audit client registrations to ensure that no wildcard domains are permitted in redirect_uri fields, thereby reducing the attack surface for open redirection attacks across all supported versions until patching is complete.