Skip to content
Threat Feed
Subscribe

Product

Pocket-Id (V2.5.0)

1 brief RSS
high threat

Pocket ID OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions

A vulnerability in the Pocket ID OpenID Connect (OIDC) `createTokenFromRefreshToken` function allows refresh tokens to bypass critical authorization controls, enabling threat actors to maintain perpetual access to client applications even after a user revokes authorization, an administrator disables the user account, or a user is removed from an allowed group.

exploited pocket-id +1 oidc authorization-bypass persistence privilege-escalation identity-and-access-management
2t 1c