CVE-2026-28512: Pocket ID Auth Bypass Vulnerability

CVE-2026-28512 Overview

CVE-2026-28512 is an Open Redirect vulnerability (CWE-601) affecting Pocket ID, an OpenID Connect (OIDC) provider that enables passkey-based authentication. A flaw in callback URL validation allows crafted redirect_uri values containing URL userinfo (@) characters to bypass legitimate callback pattern checks. This vulnerability enables attackers to redirect authorization codes to attacker-controlled hosts, potentially compromising user authentication sessions.

Critical Impact
Authorization codes can be redirected to attacker-controlled servers, enabling account takeover and unauthorized access to services protected by Pocket ID authentication.

Affected Products

Pocket ID versions 2.0.0 through 2.3.x
Pocket ID OIDC authentication flows using callback URL validation
Services relying on Pocket ID for passkey authentication

Discovery Timeline

2026-03-10 - CVE CVE-2026-28512 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28512

Vulnerability Analysis

This vulnerability exploits a weakness in how Pocket ID validates OAuth 2.0/OIDC redirect_uri parameters during the authorization flow. The callback URL validation mechanism fails to properly handle URLs containing userinfo components (the @ character in URLs). In URL syntax, the userinfo component appears before the @ symbol and before the actual host, allowing attackers to craft malicious URIs that appear to match legitimate callback patterns while actually redirecting to attacker-controlled domains.

For example, a crafted URI like https://legitimate-site.com@attacker.com/callback would pass validation checks expecting legitimate-site.com but actually redirect to attacker.com. This is a classic URL parsing confusion attack that exploits differences in how URL components are interpreted.

Root Cause

The root cause lies in inadequate URL pattern matching within the callback validation logic. The original implementation used string-based or regex-based matching that failed to properly parse and validate the host component of URLs containing userinfo sections. The validation compared the apparent hostname without accounting for the userinfo-to-host separation defined in RFC 3986.

Attack Vector

The attack is network-based and requires user interaction. An attacker must trick a victim into clicking a malicious authorization link. The attack flow proceeds as follows:

Attacker crafts an authorization URL with a malicious redirect_uri containing the @ bypass technique
Victim clicks the malicious link, initiating an OIDC authentication flow
Pocket ID validates the redirect_uri but incorrectly interprets the hostname
After successful authentication, Pocket ID redirects the authorization code to the attacker's server
Attacker captures the authorization code and can exchange it for access tokens

The security patch addresses this by implementing the go-urlpattern library for proper URL pattern matching:

text

 	github.com/cenkalti/backoff/v5 v5.0.3
 	github.com/disintegration/imageorient v0.0.0-20180920195336-8147d86e83ec
 	github.com/disintegration/imaging v1.6.2
+	github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
 	github.com/emersion/go-smtp v0.24.0
 	github.com/gin-contrib/slog v1.2.0

Source: GitHub Commit

The validation logic was refactored to properly parse URLs:

 package dto
 
 import (
-	"net/url"
 	"regexp"
-	"strings"
 	"time"
 
 	"github.com/pocket-id/pocket-id/backend/internal/utils"

Source: GitHub Commit

Detection Methods for CVE-2026-28512

Indicators of Compromise

Authorization requests containing @ characters in redirect_uri parameters
Unexpected callback redirections to external domains
Authorization codes being sent to domains not in the registered callback URL list
User complaints about unexpected redirects during authentication flows

Detection Strategies

Monitor OIDC authorization endpoint logs for redirect_uri parameters containing @ characters followed by unexpected domains
Implement alerting on authorization code exchanges from IP addresses not associated with legitimate callback servers
Review web application firewall (WAF) logs for suspicious URL patterns in OAuth flows
Analyze authentication server logs for patterns indicating open redirect exploitation attempts

Monitoring Recommendations

Enable detailed logging for all OAuth 2.0/OIDC authorization requests including full redirect_uri values
Configure SIEM rules to detect URL userinfo bypass patterns in authentication flows
Monitor for spikes in failed or unusual callback URL validation events
Track authorization code usage patterns to identify potential stolen code redemption

How to Mitigate CVE-2026-28512

Immediate Actions Required

Upgrade Pocket ID to version 2.4.0 or later immediately
Review OAuth client configurations for overly permissive callback URL patterns
Audit authentication logs for signs of exploitation during the vulnerability window
Notify users if suspicious authentication activity is detected

Patch Information

The vulnerability is fixed in Pocket ID version 2.4.0. The fix implements the go-urlpattern library (specifically github.com/dunglas/go-urlpattern) for robust URL pattern matching that correctly handles URL components including userinfo sections. Review the GitHub Security Advisory GHSA-9h33-g3ww-mqff for complete details and the security patch commit for implementation specifics.

Workarounds

If immediate upgrade is not possible, implement additional callback URL validation at the reverse proxy or WAF level to reject URLs containing @ characters
Restrict registered callback URLs to exact matches rather than wildcard patterns
Consider temporarily disabling public-facing authentication flows until patched
Implement strict Content Security Policy headers to limit redirect destinations

bash

# Configuration example - WAF rule to block suspicious redirect_uri patterns
# For nginx/ModSecurity:
SecRule ARGS:redirect_uri "@contains @" "id:1001,phase:1,deny,status:403,msg:'Suspicious redirect_uri pattern detected'"