CVE-2026-28513

Pocket ID is an OIDC provider. Before version 2.4.0, the token endpoint could accept an authorization code that is expired when the client ID is correct, enabling cross-client code reuse and expired-code reuse. The issue is fixed in 2.4.0. No exploitation path details are provided beyond that, an...

CVE-2026-0846

creationtimestamp| type| source ---|---|--- 2026-03-09 19:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-0846 2026-03-09 21:00:17+00:00| seen| https://infosec.exchange/users/offseq/statuses/116201227310498723 2026-04-18 08:37:08+00:00| seen|...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the OIDC token exchange process. An attacker can obtain tokens for unauthorized clients or reuse expired authorization codes by submitting a valid authorization code with a different client ID or by using an...

EUVD-2026-10408

Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange...

GHSA-QH6Q-598W-W6M2 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

Summary The OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. Details backend/internal/service/oidcservice.go:407 go if authorizationCodeMetaData.ClientID != input.ClientI...

CVE-2025-15547

creationtimestamp| type| source ---|---|--- 2026-03-09 12:22:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116199191644869912...

CVE-2025-15576

CVE-2025-15576 describes a jail/chroot escape in FreeBSD. When two sibling jails are restricted to separate filesystem trees, processes in the two jails can still exchange directory descriptors via a unix domain socket and access a shared directory mounted with nullfs. During a filesystem name lo...

CVE-2025-41766

creationtimestamp| type| source ---|---|--- 2026-03-09 11:42:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116199032876308228...

CVE-2026-3823

creationtimestamp| type| source ---|---|--- 2026-03-09 06:05:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10753-e091e-2.html 2026-03-09 06:16:04+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3823 2026-03-09 06:58:35+00:00| seen|...

CVE-2026-3630

creationtimestamp| type| source ---|---|--- 2026-03-09 03:15:58+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3630 2026-03-09 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116197335245358042 2026-03-09 07:12:12+00:00| seen|...

PT-2026-24137

Name of the Vulnerable Software and Affected Versions Pocket ID versions prior to 2.4.0 Description Pocket ID is an OIDC provider susceptible to cross-client code exchange and expired code reuse. The OIDC token endpoint incorrectly validates authorization codes, only rejecting them when both the...

CVE-2026-3787

creationtimestamp| type| source ---|---|--- 2026-03-08 22:15:50+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3787 2026-03-09 00:00:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116196274309154514...

CVE-2026-3768

creationtimestamp| type| source ---|---|--- 2026-03-08 20:15:51+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3768 2026-03-09 03:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116196981604748824...

CVE-2026-3729

creationtimestamp| type| source ---|---|--- 2026-03-08 08:28:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116192609218289179 2026-03-08 10:15:49+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3729...

CVE-2026-3726

creationtimestamp| type| source ---|---|--- 2026-03-08 08:16:18+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3726 2026-03-08 10:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116192970509825187...

CVE-2026-3769

creationtimestamp| type| source ---|---|--- 2026-03-08 08:15:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116192556598077213 2026-03-08 20:15:51+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3769 2026-03-09 01:30:27+00:00| seen|...

CVE-2026-3715

creationtimestamp| type| source ---|---|--- 2026-03-08 06:16:13+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3715 2026-03-08 08:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116192616692133181 2026-03-22 19:40:09+00:00| seen|...

CVE-2026-3703

creationtimestamp| type| source ---|---|--- 2026-03-07 09:04:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116187088470565178 2026-03-08 04:16:29+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3703 2026-03-08 05:30:27+00:00| seen|...

CVE-2026-24308

creationtimestamp| type| source ---|---|--- 2026-03-07 08:16:07+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-24308 2026-03-07 10:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116187426198968970 2026-03-07 10:30:33+00:00| seen|...

CVE-2026-3679

creationtimestamp| type| source ---|---|--- 2026-03-06 21:36:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116184381636813177 2026-03-07 22:15:47+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3679 2026-03-13 06:33:11+00:00| seen|...