CVE-2026-62662

Pocket ID versions 1.11.0 through 2.10.0 are vulnerable to an improper authorization flaw in the createTokenFromClientCredentials function within backend/internal/service/oidc_service.go. The root cause is that the system accepts a client-controlled resource parameter and embeds it into the acces...

PT-2026-137234

Name of the Vulnerable Software and Affected Versions Pocket ID versions 1.11.0 through 2.9.9 Description An issue exists in the OIDC provider where the createTokenFromClientCredentials function in backend/internal/service/oidc service.go accepts a client-controlled resource parameter and embeds ...