CVE-2026-55834: Pocket ID Auth Bypass Vulnerability

CVE-2026-55834 Overview

CVE-2026-55834 is an open redirect vulnerability in Pocket ID, an OpenID Connect (OIDC) provider that allows users to authenticate with passkeys. Affected versions from 2.6.0 up to (but not including) 2.9.0 read the redirect_uri query parameter on the client side and use the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript: and data: schemes, skipping the backend callback allow-list. An unauthenticated attacker who knows a valid client_id can redirect victims to an arbitrary HTTP or HTTPS origin. The issue is tracked as CWE-601: URL Redirection to Untrusted Site and is fixed in version 2.9.0.

Critical Impact
An attacker can craft an authorize URL that redirects victims to an attacker-controlled origin, enabling phishing and OIDC error and state smuggling against Pocket ID users.

Affected Products

Pocket ID 2.6.0
Pocket ID versions after 2.6.0 and before 2.9.0
Fixed in Pocket ID 2.9.0

Discovery Timeline

2026-08-28 - CVE-2026-55834 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55834

Vulnerability Analysis

The vulnerability lives in the authorize flow of Pocket ID's SvelteKit frontend. frontend/src/routes/authorize/+page.ts reads the untrusted redirect_uri query parameter directly from the request URL. frontend/src/routes/authorize/+page.svelte then passes the raw callbackURL to a redirectWithError helper when silent authorization with prompt=none cannot complete.

The client-side code performs only a minimal scheme check that blocks javascript: and data: URIs. It never calls the backend to validate the callback against the OIDC client's registered allow-list. Any well-formed http:// or https:// origin is therefore accepted and used as a navigation target.

Because the endpoint is reachable without authentication, an attacker only needs to know a valid client_id registered with the Pocket ID instance. The attacker then delivers a crafted authorize URL to a victim; the browser follows the redirect to an attacker-controlled origin carrying attacker-influenced OIDC error and state parameters.

Root Cause

The root cause is missing server-side validation of redirect_uri in the prompt=none error path. Trust for callback URL enforcement was placed entirely in client-side logic, and that logic checked only URL scheme rather than membership in the registered callback allow-list maintained in the backend.

Attack Vector

Exploitation requires user interaction: a victim must click a link or visit a page that loads the malicious authorize URL. No credentials or privileges are required on the Pocket ID instance. The attacker supplies a valid client_id, a benign-looking scope, prompt=none, and an attacker-controlled redirect_uri. When silent authorization fails, the frontend navigates the browser to the attacker's origin, appending OIDC error metadata that can be smuggled into follow-on phishing content.

// Patch: new backend endpoint that validates callback URLs against the
// registered allow-list, invoked from the authorize flow.
group.POST("/oidc/authorize", authMiddleware.WithAdminNotRequired().Add(), oc.authorizeHandler)
group.POST("/oidc/authorize/callback-url", oc.authorizeCallbackURLHandler)
group.POST("/oidc/authorization-required", authMiddleware.WithAdminNotRequired().Add(), oc.authorizationConfirmationRequiredHandler)
group.GET("/oidc/par-request-info", authMiddleware.WithAdminNotRequired().Add(), oc.parRequestInfoHandler)

Source: pocket-id commit 8a75774 — adds a dedicated backend route so callback URL validation runs server-side even when prompt=none short-circuits the interactive flow.

// Patch: DTOs introduced to model the callback-URL validation request
// and response between the frontend and the backend.
type AuthorizeOidcClientCallbackRequestDto struct {
    ClientID    string `json:"clientID" binding:"required"`
    CallbackURL string `json:"callbackURL"`
    RequestURI  string `json:"requestURI"`
}

type AuthorizeOidcClientCallbackResponseDto struct {
    CallbackURL string `json:"callbackURL"`
}

Source: pocket-id commit 8a75774 — the frontend now submits clientID, callbackURL, and requestURI to the backend, which returns a validated callback URL to use.

Detection Methods for CVE-2026-55834

Indicators of Compromise

Requests to /authorize containing a redirect_uri whose host is not on the registered callback allow-list for the given client_id.
Authorize requests combining prompt=none with an external redirect_uri targeting third-party domains.
Outbound HTTP referrers from the Pocket ID /authorize route pointing to unfamiliar origins carrying error, error_description, and state query parameters.

Detection Strategies

Parse Pocket ID access logs and alert when the redirect_uri parameter's host does not match any callback registered for the associated OIDC client.
Correlate authorize traffic with the client registry to flag mismatches between requested redirect_uri and the client's known callbacks.
Hunt for phishing kits reusing your Pocket ID client_id values by monitoring brand-abuse and passive DNS feeds for typosquatted domains referenced in redirect_uri.

Monitoring Recommendations

Enable verbose logging of the OIDC authorize endpoint, capturing client_id, redirect_uri, prompt, and originating IP.
Forward Pocket ID logs to a centralized analytics platform to build baselines of legitimate callback destinations per client.
Alert on spikes of prompt=none requests that end in redirects to previously unseen external hosts.

How to Mitigate CVE-2026-55834

Immediate Actions Required

Upgrade Pocket ID to version 2.9.0 or later, which introduces server-side callback URL validation in the prompt=none path.
Audit registered OIDC clients and tighten each client's callback URL allow-list to the minimum set of exact URIs required.
Review recent authorize logs for suspicious redirect_uri values and notify potentially phished users.

Patch Information

The fix is included in Pocket ID release v2.9.0. Technical remediation details are described in GitHub Security Advisory GHSA-2wvm-8mvp-22qv and the corresponding commit 8a75774. The patch adds a POST /oidc/authorize/callback-url endpoint and new request and response DTOs so the frontend must confirm any callback URL against the backend allow-list before navigating the browser.

Workarounds

If upgrading immediately is not possible, restrict network access to the Pocket ID /authorize endpoint via an authenticating reverse proxy or WAF rule that rejects requests whose redirect_uri host is not on an operator-maintained allow-list.
Configure a WAF rule to block authorize requests where prompt=none is combined with a redirect_uri pointing to an external domain.
Disable or remove unused OIDC clients to reduce the pool of valid client_id values that an attacker could abuse.

bash

# Example: upgrade Pocket ID container to the patched release
docker pull ghcr.io/pocket-id/pocket-id:v2.9.0
docker stop pocket-id && docker rm pocket-id
docker run -d --name pocket-id \
  -p 3000:3000 \
  -v pocket-id-data:/app/data \
  ghcr.io/pocket-id/pocket-id:v2.9.0