Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method in github.com/pocket-id/pocket-id/backend

Description

References

• pocket-id/pocket-id security advisory · ADVISORY
• pocket-id/pocket-id commit 978ac87 · WEB
• pocket-id/pocket-id release v2.6.0 · WEB

More vulnerabilities in github.com/pocket-id/pocket-id/backend

• CVE-2026-55834MEDIUM 4.3Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes…
• GHSA-hp74-gm6m-2qm5MEDIUMPocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that a…
• CVE-2026-43983HIGH 8.1Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRef…
• CVE-2026-28513HIGH 7.1Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoin…
• CVE-2026-28512MEDIUM 6.1Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in …