CVE-2026-28513

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28513", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T20:57:47.710Z", "datePublished": "2026-03-09T22:19:30.000Z", "dateUpdated": "2026-03-10T14:32:17.637Z"}, "containers": {"cna": {"title": "Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2"}], "affected": [{"vendor": "pocket-id", "product": "pocket-id", "versions": [{"version": "< 2.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:19:30.000Z"}, "descriptions": [{"lang": "en", "value": "Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0."}], "source": {"advisory": "GHSA-qh6q-598w-w6m2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:32:14.209950Z", "id": "CVE-2026-28513", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:32:17.637Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange", "source": {"advisory": "GHSA-qh6q-598w-w6m2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pocket-id", "product": "pocket-id", "versions": [{"status": "affected", "version": "< 2.4.0"}]}], "references": [{"url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2", "name": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:19:30.000Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28513", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:32:14.209950Z"}}}], "references": [{"url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-10T14:32:09.047Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-28513", "state": "PUBLISHED", "dateUpdated": "2026-03-09T22:19:30.000Z", "dateReserved": "2026-02-27T20:57:47.710Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T22:19:30.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pocket-id", "vendor": "pocket-id", "versions": [{"status": "affected", "version": "< 2.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:*", "matchCriteriaId": "08E85575-4AB8-455C-837E-57B0052B5C3E", "versionEndExcluding": "2.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0."}, {"lang": "es", "value": "Pocket ID es un proveedor OIDC que permite a los usuarios autenticarse con sus passkeys en sus servicios. Antes de la 2.4.0, el endpoint de token OIDC rechaza un c\u00f3digo de autorizaci\u00f3n solo cuando tanto el ID del cliente es incorrecto como el c\u00f3digo ha expirado. Esto permite el intercambio de c\u00f3digo entre clientes y la reutilizaci\u00f3n de c\u00f3digos expirados. Esta vulnerabilidad se ha corregido en la 2.4.0."}], "id": "CVE-2026-28513", "lastModified": "2026-06-17T10:28:46.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28513", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:32:14.209950Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:38:50.303", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pocket-id", "source": "cna", "vendor": "pocket-id"}, "product": "pocket-id", "vendor": "pocket-id"}], "analysis": {"en": {"generated_at": "2026-04-17T11:48:38.108665+00:00", "value": {"mitigation_remediation": ["Upgrade Pocket ID to version 2.4.0 or later, which fixes the authorization code validation logic.", "If an upgrade is not immediately possible, configure the token endpoint to reject any request where the client ID does not match the code issuer, effectively re\u2011implementing the correct OR logic on the server side.", "Monitor token exchanges for anomalous client ID and code pairs and alert on repeated cross\u2011client attempts to detect exploitation in progress."], "summary": {"action": "Patch", "impact": "Unauthorized Token Acquisition via Cross\u2011Client Code Replay"}, "threat_synthesis": {"affected_systems": "The affected product is Pocket ID (pocket-id:pocket-id). Versions prior to 2.4.0 have the vulnerability. Users running any earlier release should upgrade to 2.4.0 or later to eliminate the issue.", "description_and_impact": "Pocket ID, an OIDC provider, incorrectly validates the authorization code during token exchange. The check requires both the client ID to match and the code to be unexpired before rejecting the request. This logical flaw means that if a client uses a valid code issued to another client, the token endpoint will still accept it, allowing the attacker to obtain tokens for unauthorized clients. Additionally, the same flaw permits re\u2011use of expired codes, further expanding the potential for abuse. The consequences include unauthorized access to services, data exposure, and potential escalation if the compromised client has elevated privileges.", "risk_and_exploitability": "The CVSS score of 8.5 places this problem in the High severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not included in CISA\u2019s KEV catalog. Attackers could exploit it by crafting a token\u2011exchange request to the /token endpoint, supplying an authorization code from another client and the corresponding client ID. The flaw allows the code to be accepted without proper validation, leading to token issuance for an unauthorized client. Because the flaw exists server\u2011side and does not require client\u2011side manipulation, no special client behavior is necessary for exploitation."}}}}, "created": "2026-03-10T14:06:37.812078+00:00", "updated": "2026-04-17T12:00:11.740192+00:00", "vendors": ["pocket-id", "pocket-id$PRODUCT$pocket-id"]}