Pocket ID up to 2.8.x Redirect URI +page.ts redirect_uri

Summaryinfo

A vulnerability classified as problematic was found in Pocket ID up to 2.8.x. This vulnerability affects unknown code of the file frontend/src/routes/authorize/+page.ts of the component Redirect URI Handler. Such manipulation of the argument redirect_uri leads to redirect. This vulnerability is uniquely identified as CVE-2026-55834. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Pocket ID up to 2.8.x. It has been rated as problematic. Affected by this issue is an unknown function of the file frontend/src/routes/authorize/+page.ts of the component Redirect URI Handler. The manipulation of the argument redirect_uri with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. CVE summarizes:

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-55834 since 06/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 2.9.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Pocket ID

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion