CVE-2026-28512: Pocket ID Auth Bypass Vulnerability

CVE-2026-28512 Overview

CVE-2026-28512 is an Open Redirect vulnerability (CWE-601) affecting Pocket ID, an OpenID Connect (OIDC) provider that enables passkey-based authentication. A flaw in callback URL validation allows crafted redirect_uri values containing URL userinfo (@) characters to bypass legitimate callback pattern checks. This vulnerability enables attackers to redirect authorization codes to attacker-controlled hosts, potentially compromising user authentication sessions.

Critical Impact

Authorization codes can be redirected to attacker-controlled servers, enabling account takeover and unauthorized access to services protected by Pocket ID authentication.

Affected Products

• Pocket ID versions 2.0.0 through 2.3.x
• Pocket ID OIDC authentication flows using callback URL validation
• Services relying on Pocket ID for passkey authentication

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-28512 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28512

Vulnerability Analysis

This vulnerability exploits a weakness in how Pocket ID validates OAuth 2.0/OIDC redirect_uri parameters during the authorization flow. The callback URL validation mechanism fails to properly handle URLs containing userinfo components (the @ character in URLs). In URL syntax, the userinfo component appears before the @ symbol and before the actual host, allowing attackers to craft malicious URIs that appear to match legitimate callback patterns while actually redirecting to attacker-controlled domains.

For example, a crafted URI like https://legitimate-site.com@attacker.com/callback would pass validation checks expecting legitimate-site.com but actually redirect to attacker.com. This is a classic URL parsing confusion attack that exploits differences in how URL components are interpreted.

Root Cause

The root cause lies in inadequate URL pattern matching within the callback validation logic. The original implementation used string-based or regex-based matching that failed to properly parse and validate the host component of URLs containing userinfo sections. The validation compared the apparent hostname without accounting for the userinfo-to-host separation defined in RFC 3986.

Attack Vector

The attack is network-based and requires user interaction. An attacker must trick a victim into clicking a malicious authorization link. The attack flow proceeds as follows:

1. Attacker crafts an authorization URL with a malicious redirect_uri containing the @ bypass technique
2. Victim clicks the malicious link, initiating an OIDC authentication flow
3. Pocket ID validates the redirect_uri but incorrectly interprets the hostname
4. After successful authentication, Pocket ID redirects the authorization code to the attacker's server
5. Attacker captures the authorization code and can exchange it for access tokens

The security patch addresses this by implementing the go-urlpattern library for proper URL pattern matching:

 	github.com/cenkalti/backoff/v5 v5.0.3
 	github.com/disintegration/imageorient v0.0.0-20180920195336-8147d86e83ec
 	github.com/disintegration/imaging v1.6.2
+	github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
 	github.com/emersion/go-smtp v0.24.0
 	github.com/gin-contrib/slog v1.2.0

Source: GitHub Commit

The validation logic was refactored to properly parse URLs:

 package dto
 
 import (
-	"net/url"
 	"regexp"
-	"strings"
 	"time"
 
 	"github.com/pocket-id/pocket-id/backend/internal/utils"

Source: GitHub Commit

Detection Methods for CVE-2026-28512

Indicators of Compromise

• Authorization requests containing @ characters in redirect_uri parameters
• Unexpected callback redirections to external domains
• Authorization codes being sent to domains not in the registered callback URL list
• User complaints about unexpected redirects during authentication flows

Detection Strategies

• Monitor OIDC authorization endpoint logs for redirect_uri parameters containing @ characters followed by unexpected domains
• Implement alerting on authorization code exchanges from IP addresses not associated with legitimate callback servers
• Review web application firewall (WAF) logs for suspicious URL patterns in OAuth flows
• Analyze authentication server logs for patterns indicating open redirect exploitation attempts

Monitoring Recommendations

• Enable detailed logging for all OAuth 2.0/OIDC authorization requests including full redirect_uri values
• Configure SIEM rules to detect URL userinfo bypass patterns in authentication flows
• Monitor for spikes in failed or unusual callback URL validation events
• Track authorization code usage patterns to identify potential stolen code redemption

How to Mitigate CVE-2026-28512

Immediate Actions Required

• Upgrade Pocket ID to version 2.4.0 or later immediately
• Review OAuth client configurations for overly permissive callback URL patterns
• Audit authentication logs for signs of exploitation during the vulnerability window
• Notify users if suspicious authentication activity is detected

Patch Information

The vulnerability is fixed in Pocket ID version 2.4.0. The fix implements the go-urlpattern library (specifically github.com/dunglas/go-urlpattern) for robust URL pattern matching that correctly handles URL components including userinfo sections. Review the GitHub Security Advisory GHSA-9h33-g3ww-mqff for complete details and the security patch commit for implementation specifics.

Workarounds

• If immediate upgrade is not possible, implement additional callback URL validation at the reverse proxy or WAF level to reject URLs containing @ characters
• Restrict registered callback URLs to exact matches rather than wildcard patterns
• Consider temporarily disabling public-facing authentication flows until patched
• Implement strict Content Security Policy headers to limit redirect destinations

# Configuration example - WAF rule to block suspicious redirect_uri patterns
# For nginx/ModSecurity:
SecRule ARGS:redirect_uri "@contains @" "id:1001,phase:1,deny,status:403,msg:'Suspicious redirect_uri pattern detected'"