CVE-2026-43983: Pocket ID Auth Bypass Vulnerability

CVE-2026-43983 Overview

Pocket ID is an OpenID Connect (OIDC) provider that authenticates users with passkeys against downstream services. Versions prior to 2.6.0 contain an authorization flaw in the createTokenFromRefreshToken function within oidc_service.go. The function validates the cryptographic integrity of refresh tokens but fails to re-check the user's current authorization state before issuing new access tokens. Attackers retaining a valid refresh token can continue obtaining tokens after access has been revoked, the account disabled, or the client removed from its assigned group. The issue is tracked as CWE-285: Improper Authorization and is fixed in Pocket ID 2.6.0.

Critical Impact
Revoked users, disabled accounts, and ex-group-members can continue accessing protected resources by refreshing OIDC tokens until the refresh token expires.

Affected Products

Pocket ID versions prior to 2.6.0
Deployments using Pocket ID as an OIDC identity provider
Downstream services relying on Pocket ID refresh token validation for session lifecycle

Discovery Timeline

2026-05-12 - CVE-2026-43983 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43983

Vulnerability Analysis

The flaw resides in the OIDC token refresh handler implemented by createTokenFromRefreshToken in oidc_service.go. When a client presents a refresh token, the function verifies the token's signature and expiration but does not query the user's current authorization state before minting a new access token. Authorization state in Pocket ID includes whether the user account is active, whether the client is still authorized for that user, and whether the user remains a member of the group granting client access.

Because these checks are absent, three abuse paths emerge. First, a user who revokes a client's authorization can continue to refresh tokens for that client. Second, a disabled account can keep receiving valid access tokens. Third, removing a user from the group that grants client access does not terminate the user's existing OIDC session.

The vulnerability requires a previously issued, still-valid refresh token. An attacker who exfiltrated a refresh token, or a legitimate user whose access should have been terminated, retains effective authorization until the refresh token itself expires.

Root Cause

The root cause is missing authorization revalidation on refresh. The function trusts the cryptographic claims embedded in the refresh token as a proxy for current authorization. Authorization decisions made at the initial grant are never reconciled with the live state of the user, client, and group bindings stored by Pocket ID.

Attack Vector

Exploitation occurs over the network against the OIDC token endpoint. An attacker submits a standard OAuth 2.0 refresh_token grant request with a previously issued refresh token. The server returns a fresh access token even after administrative actions that should have invalidated the session. No additional user interaction is required once the refresh token is held by the attacker or revoked user.

The vulnerability mechanism is described in the Pocket ID security advisory GHSA-w6p7-2fxx-4f44. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-43983

Indicators of Compromise

Successful /oauth/token responses for users whose accounts are disabled in the Pocket ID admin console.
Refresh token grants issued for client and user pairs where the client authorization was previously revoked.
OIDC access tokens used against downstream services by accounts removed from their access-granting group.

Detection Strategies

Correlate Pocket ID admin events (account disable, authorization revoke, group removal) with subsequent token issuance for the same user within the refresh token lifetime.
Audit createTokenFromRefreshToken log entries to flag refreshes performed after a revocation event timestamp.
Inspect downstream service access logs for sessions belonging to deprovisioned identities.

Monitoring Recommendations

Forward Pocket ID authentication and admin logs to a centralized log platform and alert on token issuance after revocation events.
Track refresh token reuse counts per user and flag anomalies for deprovisioned accounts.
Monitor downstream OIDC relying parties for active sessions tied to disabled Pocket ID accounts.

How to Mitigate CVE-2026-43983

Immediate Actions Required

Upgrade all Pocket ID instances to version 2.6.0 or later, where the authorization recheck is enforced on every refresh.
Invalidate all outstanding refresh tokens after upgrade to force re-authentication.
Audit recent disable, revoke, and group-removal events and verify that the affected users no longer hold active sessions on downstream services.

Patch Information

The maintainers fixed the issue in Pocket ID 2.6.0 by re-validating the user's authorization state inside createTokenFromRefreshToken before issuing new tokens. Patch details are documented in the GitHub security advisory GHSA-w6p7-2fxx-4f44.

Workarounds

Shorten refresh token lifetimes in Pocket ID configuration to reduce the window of abuse until 2.6.0 is deployed.
Manually purge refresh tokens from the Pocket ID database whenever an account is disabled, revoked, or removed from a group.
Configure downstream relying parties to perform short-lived session validation against Pocket ID's userinfo endpoint rather than relying solely on access token validity.

bash

# Verify Pocket ID version after upgrade
docker exec pocket-id /app/pocket-id --version
# Expected output: 2.6.0 or later