CVE-2026-62662

Pocket ID versions 1.11.0 through 2.10.0 are vulnerable to an improper authorization flaw in the createTokenFromClientCredentials function within backend/internal/service/oidc_service.go. The root cause is that the system accepts a client-controlled resource parameter and embeds it into the acces...