Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28513 Pocket ID OIDC Token Endpoint Vulnerability Enables Cross-Client Code Exchange https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28513
Post summary
The post announces CVE‑2026‑28513 as an OIDC token‑endpoint flaw allowing cross‑client code exchange, but offers no exploitation, mitigation, or PoC details.
[CVE-2026-28513: HIGH] Update to Pocket ID 2.4.0 now! Fixing a vulnerability that allowed cross-client code exchange and expired code reuse, enhancing cyber security. #OIDC #cybersecurity#cve,CVE-2026-28513,#cybersecurity https://cvefind.com/CVE-2026-28513
Post summary
Pocket ID 2.4.0 has released an update that patches CVE-2026-28513, fixing issues related to cross-client code exchange and expired code reuse.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pocket-id | pocket_id | - | - | - |