Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/pocket-id/pocket-id/backend | go | >= 2.6.0, <= 2.8.0 | 2.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55834, describes an Open Redirect issue in Pocket ID's OIDC /authorize page. Specifically, it states that frontend/src/routes/authorize/+page.ts reads the redirect_uri and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot complete silent authorization. The client-side validation was insufficient, bypassing backend allow-list checks.
I analyzed the provided commit 8a7577497131229badb35cb4b3a4227b1300afff, which is explicitly linked as the fix. The changes clearly show that the redirectWithError function in frontend/src/routes/authorize/+page.svelte was the point of exploitation. Before the fix, this function directly used the callbackURL from the URL parameters to set window.location.href, with only a rudimentary check for javascript: or data: protocols. This allowed an attacker to craft a malicious redirect_uri to an arbitrary domain.
The patch introduces a new asynchronous flow within redirectWithError. It now calls oidcService.resolveAuthorizeCallbackURL (which in turn calls a new backend endpoint and service function) to obtain a safeCallbackURL. This safeCallbackURL is then used for the redirection, ensuring that the redirect_uri has been validated against the client's registered callback URLs on the backend. Therefore, the redirectWithError function, in its state prior to this patch, was the vulnerable component responsible for the open redirect.
redirectWithErrorfrontend/src/routes/authorize/+page.svelte