---
id: CVE-2026-55834
title: >-
  Pocket ID is an OIDC provider that allows users to authenticate with their
  passkeys to services
summary: >-
  Pocket ID is an OIDC provider that allows users to authenticate with their
  passkeys to services. From 2.6.0 until 2.9.0,
  frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter
  and frontend/src/routes/authorize/+pag…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-601
vendor: pocket-id
product: github.com/pocket-id/pocket-id/backend
affected:
  - 'github.com/pocket-id/pocket-id/backend >= 2.6.0, <= 2.8.0'
patched:
  - github.com/pocket-id/pocket-id/backend 2.9.0
published: '2026-08-28'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55834'
references:
  - url: >-
      https://github.com/pocket-id/pocket-id/commit/8a7577497131229badb35cb4b3a4227b1300afff
    label: security-advisories@github.com
  - url: 'https://github.com/pocket-id/pocket-id/releases/tag/v2.9.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/pocket-id/pocket-id/security/advisories/GHSA-2wvm-8mvp-22qv
    label: security-advisories@github.com
  - url: >-
      https://github.com/pocket-id/pocket-id/security/advisories/GHSA-2wvm-8mvp-22qv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-2wvm-8mvp-22qv'
tags:
  - nvd
  - ghsa
  - go
epss: 0.00269
epssPercentile: 0.19329
aliases:
  - GHSA-2wvm-8mvp-22qv
ecosystem: go
ingestedAt: '2026-08-28T17:22:56.945Z'
---

## Overview

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55834)

Affected packages:

- `github.com/pocket-id/pocket-id/backend >= 2.6.0, <= 2.8.0`

Patched in:

- `github.com/pocket-id/pocket-id/backend 2.9.0`

Source: https://github.com/advisories/GHSA-2wvm-8mvp-22qv