{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apocket-idpocket-id/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pocket-id:pocket-id:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-62662"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pocket ID (\u003c 0.0.0-20260622164202-8158452b3730)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Pocket ID"],"content_html":"\u003cp\u003ePocket ID is vulnerable to an authentication bypass via its OAuth 2.0 client credentials grant implementation. The application fails to validate the \u003ccode\u003eresource\u003c/code\u003e parameter provided during the token request in \u003ccode\u003ebackend/internal/service/oidc_service.go\u003c/code\u003e. As a result, any authenticated client can request a token for any audience, including other registered service clients. The system lacks a registry of permitted audiences or authorization policies per client, allowing malicious clients to forge tokens that appear legitimate to downstream resource servers. This vulnerability is tracked as CVE-2026-62662.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker acquires valid credentials for a registered OIDC client.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an OAuth 2.0 \u003ccode\u003eclient_credentials\u003c/code\u003e grant request to the Pocket ID token endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects an arbitrary value into the \u003ccode\u003eresource\u003c/code\u003e field of the HTTP POST request.\u003c/li\u003e\n\u003cli\u003ePocket ID validates the attacker's client credentials.\u003c/li\u003e\n\u003cli\u003ePocket ID fails to validate the \u003ccode\u003eresource\u003c/code\u003e parameter against any allowlist or registered client metadata.\u003c/li\u003e\n\u003cli\u003ePocket ID embeds the attacker-provided \u003ccode\u003eresource\u003c/code\u003e value into the \u003ccode\u003eaud\u003c/code\u003e (audience) claim of the generated JWT.\u003c/li\u003e\n\u003cli\u003eAttacker receives the signed token and uses it to authenticate against a target resource server.\u003c/li\u003e\n\u003cli\u003eTarget resource server validates the token against Pocket ID's JWKS and incorrectly accepts the token due to the spoofed \u003ccode\u003eaud\u003c/code\u003e claim.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a compromised or malicious client to impersonate authorized service traffic, effectively breaking service-to-service isolation. The attacker can bypass audience-based access controls and gain unauthorized access to any resource server that relies on Pocket ID for token validation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Pocket ID to version 0.0.0-20260622164202-8158452b3730 or later immediately to include mandatory resource validation.\u003c/li\u003e\n\u003cli\u003eAudit all existing OAuth clients for anomalous token requests to unexpected resource audiences.\u003c/li\u003e\n\u003cli\u003eImplement strict audience validation logic on all downstream resource servers to verify that the \u003ccode\u003eaud\u003c/code\u003e claim matches the specific resource identity, even if the token signature is valid.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-09T22:14:31Z","date_published":"2026-11-09T22:14:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pocket-id-auth-bypass/","summary":"Pocket ID contains an authentication bypass vulnerability where an authenticated OIDC client can supply an arbitrary resource parameter to obtain a signed access token for any audience, effectively bypassing service-to-service access controls.","title":"Pocket ID: Arbitrary audience injection in client credentials grant (CVE-2026-62662)","url":"https://feed.craftedsignal.io/briefs/2026-11-pocket-id-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pocket-Id:pocket-Id:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}