CVE-2026-28513

CVE-2026-28513 impacts Pocket ID, an OIDC provider, in versions prior to 2.4.0, stemming from inadequate authorization code validation at its token endpoint. This vulnerability allows for cross-client code exchange and the reuse of expired codes, potentially leading to unauthorized access to user data. Rated 7.1 HIGH, it has a network attack vector and low attack complexity, enabling an attacker with low privileges to achieve high confidentiality and low integrity impact. There is currently no evidence of active exploitation, no public exploit code available, and community attention remains very limited.