A flaw in Pocket ID’s callback URL validation allowed redirect_uri values that include an @ symbol in the host component to bypass legitimate callback pattern checks. An attacker can craft a malicious authorization link that, when clicked by a user, sends the resulting authorization code to an attacker‑controlled host instead of the intended client. This can enable the attacker to obtain the authorization code and subsequently exchange it for tokens, effectively compromising user credentials and granting unauthorized access to protected resources. The weakness lies in improper input validation of redirect URIs (CWE‑601).

Pocket ID versions 2.0.0 through 2.3.x are affected. Users deploying these versions should verify if they are running any of those releases and plan an upgrade to 2.4.0 or later where the validation bug has been fixed.

The vulnerability has a CVSS score of 7.1, indicating high severity. The EPSS score is below 1%, suggesting a low probability of real‑world exploitation at present. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to entice a user to click a crafted OAuth request; if successful, the authorization code can be captured and misused. No other conditions are required. The attacker’s path hinges on user interaction with the malicious link and the business logic that accepts the redirect_uri without proper checks.