CVE-2026-55834

Name of the Vulnerable Software and Affected Versions Pocket ID versions 2.6.0 through 2.8.0

Description The OIDC authorization page in the frontend redirects the browser to an attacker-controlled URL without consulting the backend redirect URI allow-list when the request uses prompt=none. An unauthenticated attacker who knows a valid client id can craft an /authorize endpoint link that sends a victim to any external HTTP or HTTPS origin. This occurs because the client-side path in frontend/src/routes/authorize/+page.ts and frontend/src/routes/authorize/+page.svelte only blocks javascript and data schemes, bypassing the backend validation function GetCallbackURLFromList(). This behavior enables phishing and OIDC error and state smuggling, as the trusted identity provider domain is used to bounce the victim to an arbitrary external site.

Recommendations Update Pocket ID to version 2.9.0.