8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28513

CVE-2026-28513: Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28513

CVE-2026-28513:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/pocket-id/pocket-id/backend	go	< 0.0.0-20260307173642-b59e35cb59ae	0.0.0-20260307173642-b59e35cb59ae

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the OIDC token endpoint's authorization code validation logic. The advisory explicitly points out the flawed conditional statement in backend/internal/service/oidc_service.go. The code used a logical AND (&&) where a logical OR (||) was required. This meant that an authorization code was rejected only if both the client ID was incorrect and the code was expired. The correct behavior is to reject the code if either of these conditions is true. I confirmed the fix by finding the commit that changed the && to ||. The commit 34890235ba8c2d856e3a121fdf59fe9d627e8596 contains this exact change in the createTokenFromAuthorizationCode function within OidcService. Therefore, during exploitation, this function would be present in the runtime profile as it processes the malicious token exchange request.

Vulnerable functions

OidcService.createTokenFromAuthorizationCode

backend/internal/service/oidc_service.go

The function uses a logical AND (`&&`) instead of a logical OR (`||`) to validate the client ID and expiration of an OIDC authorization code. This allows an attacker to bypass the client ID check if the code is not expired, or bypass the expiration check if the client ID is correct. This enables cross-client token exchange and reuse of expired codes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.