Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 10, 2026 · NIST NVD

   Detected

   Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

2. Jun 17, 2026 · NIST NVD

   Updated

   Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

Affected

• cpe pocket-id/pocket idversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-28513

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28513

  Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and ex

  nvd.nist.gov

References

• Exploit · github.com