Pocket ID: Arbitrary audience injection in client credentials grant (CVE-2026-62662)

Pocket ID is vulnerable to an authentication bypass via its OAuth 2.0 client credentials grant implementation. The application fails to validate the resource parameter provided during the token request in backend/internal/service/oidc_service.go. As a result, any authenticated client can request a token for any audience, including other registered service clients. The system lacks a registry of permitted audiences or authorization policies per client, allowing malicious clients to forge tokens that appear legitimate to downstream resource servers. This vulnerability is tracked as CVE-2026-62662.

Attack Chain

1. Attacker acquires valid credentials for a registered OIDC client.
2. Attacker initiates an OAuth 2.0 client_credentials grant request to the Pocket ID token endpoint.
3. Attacker injects an arbitrary value into the resource field of the HTTP POST request.
4. Pocket ID validates the attacker's client credentials.
5. Pocket ID fails to validate the resource parameter against any allowlist or registered client metadata.
6. Pocket ID embeds the attacker-provided resource value into the aud (audience) claim of the generated JWT.
7. Attacker receives the signed token and uses it to authenticate against a target resource server.
8. Target resource server validates the token against Pocket ID's JWKS and incorrectly accepts the token due to the spoofed aud claim.

Impact

Successful exploitation allows a compromised or malicious client to impersonate authorized service traffic, effectively breaking service-to-service isolation. The attacker can bypass audience-based access controls and gain unauthorized access to any resource server that relies on Pocket ID for token validation.

Recommendation

1. Upgrade Pocket ID to version 0.0.0-20260622164202-8158452b3730 or later immediately to include mandatory resource validation.
2. Audit all existing OAuth clients for anomalous token requests to unexpected resource audiences.
3. Implement strict audience validation logic on all downstream resource servers to verify that the aud claim matches the specific resource identity, even if the token signature is valid.