CVE-2026-62662

Name of the Vulnerable Software and Affected Versions Pocket ID versions 1.11.0 through 2.9.9

Description An issue exists in the OIDC provider where the createTokenFromClientCredentials() function in backend/internal/service/oidc service.go accepts a client-controlled resource parameter and embeds it directly into the access token aud claim without validating if the audience is registered or if the requesting client has access to it. This allows an authenticated OIDC client to obtain a signed token naming an arbitrary audience or another client. The /api/oidc/introspect endpoint fails to distinguish these unauthorized tokens because it marks a token as active if the introspecting client's identifier matches the attacker-selected audience. In environments where resource servers rely on these tokens for service-to-service authorization, this can bypass audience-based access controls, potentially leading to unauthorized data access or actions.

Recommendations Update to version 2.10.0.