{"id":"CVE-2026-62662","kind":"vulnerability","aliases":["CVE-2026-62662"],"related":[],"title":"Pocket ID: client-supplied audience lets clients forge access tokens for other services","description":"Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds it directly in the access token aud claim without validating that the audience is registered or that the requesting client may access it. Any authenticated OIDC client can therefore obtain a Pocket ID-signed token naming another client or an arbitrary audience. The /api/oidc/introspect endpoint cannot distinguish the unauthorized token because it treats a token as active when the introspecting client's identifier matches the attacker-selected audience. In deployments where resource servers trust Pocket ID access tokens for service-to-service authorization, this bypasses audience-based access controls and can permit unauthorized data access or actions; deployments that do not use these tokens for resource-server authorization have no immediate exploitable impact. This issue is fixed in version 2.10.0.","summary":"Pocket ID, an OIDC login provider, copies a client-chosen resource value into the audience claim of access tokens it signs, without checking it. Any authenticated OIDC client can obtain a Pocket ID-signed token addressed to another client or arbitrary audience, which can be used to access services that trust those tokens.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oidc","package","pocket-id","self-hosted","service-to-service"],"not_affected_if":["no-token-based-resource-authorization","version-2.10.0-or-later"],"how_to_check":"- Check the running Pocket ID version; it is affected from `1.11.0` up to but not including `2.10.0`.\n- Check whether any resource server accepts Pocket ID access tokens for authorization by audience (`aud` claim checks).\n- Check whether the `/api/oidc/introspect` endpoint is used to decide token activity.","fix":"- Pocket ID: move to `2.10.0`.","status":"open","published_at":"2026-11-04T23:17:56+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:31:48+00:00","updated_at":"2026-11-05T00:31:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T00:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- Pocket ID: move to `2.10.0`.","reach":"network","title":"Pocket ID: client-supplied audience lets clients forge access tokens for other services","impact":"high","summary":"Pocket ID, an OIDC login provider, copies a client-chosen resource value into the audience claim of access tokens it signs, without checking it. Any authenticated OIDC client can obtain a Pocket ID-signed token addressed to another client or arbitrary audience, which can be used to access services that trust those tokens.","audience":"businesses","category":"package","nicknames":[],"who_cares":["pocket-id","oidc","self-hosted","service-to-service"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads or acts on other services by forging audience-targeted tokens","analyst_note":"","how_to_check":"- Check the running Pocket ID version; it is affected from `1.11.0` up to but not including `2.10.0`.\n- Check whether any resource server accepts Pocket ID access tokens for authorization by audience (`aud` claim checks).\n- Check whether the `/api/oidc/introspect` endpoint is used to decide token activity.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.10.0-or-later","no-token-based-resource-authorization"],"who_is_affected":"Pocket ID deployments from 1.11.0 before 2.10.0 are exposed, and the impact is real only where downstream resource servers trust Pocket ID access tokens for service-to-service authorization by audience. Deployments that use Pocket ID only for user login, without relying on these tokens to authorize access to other services, have no immediate exploitable impact per the advisory.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4494,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-62662':17A,20A '/api/oidc/introspect':164C '1.11.0':105C '2.10.0':107C,244C 'accept':111C 'access':10A,51B,82B,124C,141C,198C,211C,218C 'action':220C 'activ':177C 'address':70B 'allow':95C 'anoth':72B,157C 'arbitrari':75B,161C 'attack':187C 'attacker-select':186C 'aud':126C 'audienc':6A,48B,76B,132C,162C,189C,209C 'audience-bas':208C 'authent':59B,98C,144C 'author':205C,232C 'backend/internal/service/oidc_service.go':110C 'base':210C 'bypass':207C 'cannot':166C 'check':56B 'chosen':43B 'claim':49B,127C 'client':4A,8A,42B,61B,73B,114C,139C,146C,158C,181C 'client-chosen':41B 'client-control':113C 'client-suppli':3A 'control':115C,212C 'copi':39B 'createtokenfromclientcredenti':108C 'cve':15A,18A 'data':217C 'deploy':191C,221C 'direct':121C 'distinguish':167C 'emb':119C 'endpoint':165C 'exploit':236C 'fix':241C 'forg':9A 'host':28B 'id':2A,25B,34B,67B,89C,153C,197C 'id-sign':66B,152C 'identifi':183C 'immedi':235C 'impact':237C 'introspect':180C 'issu':239C 'let':7A 'login':37B 'match':184C 'may':140C 'name':156C 'obtain':63B,149C 'oidc':21B,36B,60B,92C,145C 'packag':22B 'paramet':117C 'passkey':101C 'permit':215C 'pocket':1A,24B,33B,65B,88C,151C,196C 'pocket-id':23B 'provid':38B,93C 'regist':134C 'request':138C 'resourc':44B,116C,193C,230C 'resource-serv':229C 'select':188C 'self':27B 'self-host':26B 'server':194C,231C 'servic':14A,30B,32B,83B,103C,202C,204C 'service-to-servic':29B,201C 'sign':54B,68B,154C 'suppli':5A 'therefor':148C 'token':11A,52B,69B,87B,125C,155C,170C,175C,199C,227C 'treat':173C 'trust':85B,195C 'unauthor':169C,216C 'use':80B,225C 'user':96C 'valid':129C 'valu':45B 'version':243C 'without':55B,128C","nicknames":[],"mitigations":[],"who_affected":"Pocket ID deployments from 1.11.0 before 2.10.0 are exposed, and the impact is real only where downstream resource servers trust Pocket ID access tokens for service-to-service authorization by audience. Deployments that use Pocket ID only for user login, without relying on these tokens to authorize access to other services, have no immediate exploitable impact per the advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","oidc","package","pocketid","selfhosted","servicetoservice"],"campaign_type":null,"first_public_at":"2026-07-13T09:04:15+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62662","severity":null,"published_at":"2026-11-04T23:17:56+00:00","modified_at":"2026-11-04T23:17:56+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null}],"documents":[{"id":71491,"url":"https://github.com/pocket-id/pocket-id/commit/8158452b37304115c97c61c3a56082ce938ce6f0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71492,"url":"https://github.com/pocket-id/pocket-id/releases/tag/v2.10.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71493,"url":"https://github.com/pocket-id/pocket-id/security/advisories/GHSA-q4xm-p75h-h9p3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-13T09:04:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}