7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28512

CVE-2026-28512: Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28512

CVE-2026-28512:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/pocket-id/pocket-id/backend	go	< 0.0.0-20260228130835-3a339e33191c	0.0.0-20260228130835-3a339e33191c

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the custom and insecure parsing of OAuth redirect_uri values. The core of the issue was in the splitParts function, which used a simple string splitting mechanism based on delimiters, including the '@' symbol. This allowed attackers to craft URLs where the userinfo part of the URL was confused with the host, for example, https://expected-host.com@malicious-host.com. The matchCallbackURL function used splitParts and would incorrectly validate such a URL against a legitimate pattern (e.g., https://expected-host.com/*).

The patch addresses this by completely removing the custom URL parsing logic (splitParts and matchPath) and replacing it with a dedicated and standardized library, dunglas/go-urlpattern. The new implementation in matchCallbackURL and the new validation function ValidateCallbackURLPattern properly parse and match URL components according to web standards, thus preventing the userinfo confusion attack. The function dto.ValidateCallbackURL was also updated to use this new, secure validation logic. Identifying calls to the old, vulnerable functions utils.matchCallbackURL or dto.ValidateCallbackURL in a runtime profile would indicate a vulnerable version.

Vulnerable functions

github.com/pocket-id/pocket-id/backend/internal/utils.matchCallbackURL

backend/internal/utils/callback_url_util.go

This function was responsible for matching a given callback URL against a registered pattern. The vulnerable version used a custom, flawed URL parser (`splitParts`) that incorrectly handled URLs containing userinfo (`@`). This allowed an attacker to craft a malicious `redirect_uri` (e.g., `https://whitelisted.com@attacker.com`) that would bypass the validation, leading to the authorization code being redirected to the attacker's domain. The function was completely refactored to use the `go-urlpattern` library for robust, structured URL matching.

github.com/pocket-id/pocket-id/backend/internal/utils.splitParts

backend/internal/utils/callback_url_util.go

This function was the root cause of the vulnerability. It was a custom URL parser that split the URL string into components based on a set of delimiters, including the '@' symbol. This naive approach to URL parsing is what created the userinfo confusion vulnerability, as it did not correctly distinguish between the userinfo part and the host part of the URL. This function was entirely removed in the patch.

github.com/pocket-id/pocket-id/backend/internal/dto.ValidateCallbackURL

backend/internal/dto/validations.go

This function provided an initial, weak validation for callback URLs. It would incorrectly consider any URL with a wildcard as valid and used `url.Parse`, which is known to be problematic for parsing URLs with credentials. This insufficient validation contributed to the overall vulnerability by allowing improperly structured patterns. The patch replaces this weak logic with a call to a new, more robust validation function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.