CVE-2026-28512

Katalog CVE

CVSS 6.1 · Medium EPSS 0,29%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada pocket-id pocket id. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pocket-id/pocket-id/security/advisories/GHSA-9h33-g3ww-mqff mitigasi · patch · advisory vendor
• https://github.com/pocket-id/pocket-id/commit/3a339e33191c31b68bf57db907f800d9de5ffbc8 patch