CyberRota Analysis
AI-GeneratedThe vulnerability affects the Pocket ID OIDC provider in versions 2.6.0 to 2.9.0, where improper handling of the redirect_uri query parameter allows unauthenticated attackers to redirect users to arbitrary HTTP or HTTPS origins. This could lead to phishing attacks or OIDC error and state smuggling. Organizations using affected versions should prioritize updating to version 2.9.0 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side path only blocks javascript and data schemes and does not invoke the backend callback allow-list validation, so an unauthenticated attacker who knows a valid client_id can redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.