Pocket ID, an OIDC provider, contains an issue in the createTokenFromRefreshToken function that verifies the cryptographic integrity of the refresh token but fails to re‑check the user’s current authorization state. As a result, a valid refresh token can be used to obtain new access tokens indefinitely even after the user’s authorization has been revoked, the account has been disabled, or the client has been removed from a group. This flaw allows an attacker to maintain unauthorized access to protected resources, effectively bypassing revocation controls. The weakness is documented by CWE‑285 (Improper Authorization) and the design flaw that leads to unnecessary token exposure is related to CWE‑613.

All installations of Pocket ID with a server version earlier than 2.6.0 are affected. No sub‑version information is provided beyond the major release number.

The CVSS score of 8.5 classifies this vulnerability as high severity. EPSS data is not available, so the current exploitation probability is unknown, but the lack of automatic revocation makes the flaw exploitable as soon as a valid refresh token is in hand. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a standard refresh‑token request to the OIDC token endpoint; no additional network or environment prerequisites are explicitly mentioned. Because the issue directly bypasses authorization revocation, it poses a significant risk for protocols that rely on Pocket ID for authentication.