Remote Code Execution Vulnerability in Pocket ID OIDC Authentication System

CVE-2026-62662

What is CVE-2026-62662?

The Pocket ID OIDC provider, from versions 1.11.0 to 2.10.0, contains a vulnerability in the createTokenFromClientCredentials function. This issue arises as the backend service directly embeds a client-controlled resource parameter into the access token's audience claim without appropriate validation. The lack of validation allows any authenticated OIDC client to generate a Pocket ID-signed token that may point to another client or a random audience. This situation results in the potential for unauthorized access to sensitive data. Specifically, the /api/oidc/introspect endpoint is unable to differentiate unauthorized tokens, as it erroneously considers tokens active if the introspecting client's ID matches the attacker-selected audience. This flaw can be exploited in environments that rely on Pocket ID tokens for service-to-service authorization, effectively subverting audience-based access controls. The issue is remedied in version 2.10.0.

References