Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:pocket-Id:pocket_id:*:*:*:*:*:*:*:*

1 brief RSS
high threat

Pocket ID OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions

A vulnerability in the Pocket ID OpenID Connect (OIDC) `createTokenFromRefreshToken` function allows refresh tokens to bypass critical authorization controls, enabling threat actors to maintain perpetual access to client applications even after a user revokes authorization, an administrator disables the user account, or a user is removed from an allowed group.

exploited pocket-id +1 oidc authorization-bypass persistence privilege-escalation identity-and-access-management
2t 1c