CPE
Pocket ID contains an authentication bypass vulnerability where an authenticated OIDC client can supply an arbitrary resource parameter to obtain a signed access token for any audience, effectively bypassing service-to-service access controls.