NPM · AUGUST 2026 · EARLY WARNING

Pocket-ID OIDC Vulnerability Under Investigation

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: pocket-id (npm)
Patched version: Not yet available

GHSA-2WVM-8MVP-22QV

An open redirect vulnerability has been reported in the Pocket-ID OIDC /authorize page. This vulnerability could enable phishing and OAuth response smuggling.

What happened

The Pocket-ID frontend reportedly redirects the browser to an attacker-controlled URL without validating the redirect_uri when using prompt=none. This behavior could facilitate phishing attacks and OAuth response smuggling. The vulnerability is currently under investigation. No authoritative version range has been published yet.

To assess your exposure, review your use of Pocket-ID and any OIDC authorization flows in your applications. Ensure that redirect_uri validation is properly implemented to prevent unauthorized redirections.

What to do about it

Upgrade to the latest version of Pocket-ID as soon as it becomes available.
Review your OIDC authorization flows for any potential misconfigurations.
Ensure that redirect_uri validation is implemented in your OIDC flows to prevent unauthorized redirections.
Monitor the primary sources for updates on the vulnerability and any official fixes.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If pocket-id is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using Pocket-ID in your applications, you may be affected. Review your use of Pocket-ID and ensure that redirect_uri validation is properly implemented.

What should I do right now?

Upgrade to the latest version of Pocket-ID as soon as it becomes available. Review your OIDC authorization flows for any potential misconfigurations.

Has an official fix been published?

No official fix has been published yet. Monitor the primary sources for updates on the vulnerability and any official fixes.

Sources

[GHSA-2wvm-8mvp-22qv] Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Join the 0Day waitlist →

← Back to all threats