Pocket-ID Frontend Open Redirect Vulnerability
- Severity
- HIGH
- Affected component
- pocket-id (npm)
- Patched version
- Not yet available
An open redirect vulnerability has been reported in the Pocket-ID frontend. This vulnerability may allow phishing and OAuth response smuggling if the redirect_uri is not validated when prompt=none is used.
What happened
An open redirect vulnerability has been identified in the Pocket-ID frontend. This vulnerability occurs when the browser is redirected to an attacker-controlled URL without validating the redirect_uri when prompt=none is used. This could potentially allow phishing attacks and OAuth response smuggling. The vulnerability is currently under investigation and no authoritative version range has been published yet.
The vulnerability was first flagged on 2026-08-28T16:28:20+00:00. The severity of this vulnerability is high because it could be exploited to perform phishing attacks and OAuth response smuggling. However, there is no evidence that this vulnerability has been exploited in the wild yet.
What to do about it
- Monitor the primary sources for updates on this vulnerability.
- If you are using Pocket-ID, consider upgrading to a version that fixes the unvalidated redirect_uri issue if one becomes available.
- Implement a workaround to validate redirect_uris server-side if an official fix is not yet available.
- Stay informed about the latest security advisories and patches for the components you use.
How 0Day would have caught this
pocket-id is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Pocket-ID, you may be affected. However, no authoritative version range has been published yet. Monitor the primary sources for updates.
What should I do right now?
Monitor the primary sources for updates on this vulnerability. If you are using Pocket-ID, consider upgrading to a version that fixes the unvalidated redirect_uri issue if one becomes available. Implement a workaround to validate redirect_uris server-side if an official fix is not yet available.
Has an official fix been published yet?
No official fix has been published yet. Monitor the primary sources for updates.