Auth bypass in Pocket-Id
CVE-2026-43983
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function (oidc_service.go) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows (1) the client to refresh the token indefinitely after authorization revocation, (2) the refresh token to continue to work after the account is disabled, and (3) the token to work after the client is removed from the group. This vulnerability is fixed in 2.6.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.001
Affected products
- Pocket-Id — versions < 2.6.0
- Pocket-Id Pocket Id
Weakness classification (CWE)
References
- github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44 (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-43983?
- CVE-2026-43983 is a high-severity vulnerability in Pocket-Id, classified under Improper Authorization. CVSS score: 8.1/10. Published 2026-05-12.
- How severe is CVE-2026-43983?
- High severity. CVSS v3 base score is 8.1 out of 10.