Pocket ID is an OpenID Connect provider that allows users to authenticate with passkeys. The vulnerability exists in releases 2.6.0 through 2.9.0, where the /authorize page reads the redirect_uri query parameter and, when prompt=none is requested, forwards the raw callback URL on the client side. Because the front‑end only blocks javascript: and data: schemes and does not invoke the backend allow‑list, an attacker who knows a valid client ID can craft a request that redirects a victim’s browser to any HTTP or HTTPS origin. This can be abused for phishing or for state smuggling, allowing the attacker to observe or manipulate the OAuth state parameter without authentication.

The affected vendor is pocket‑id. The vulnerable product is Pocket ID versions 2.6.0 through 2.9.0. The fix was delivered in v2.9.0 and includes server‑side validation of redirect_uri against each client’s allowed origins.

The CVSS score of 4.3 reflects a moderate severity with the requirement of a known client ID and a public redirect to the /authorize endpoint. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. An attacker can trigger the exploit via a crafted URL over the public internet, so the risk is non‑zero but moderate. Upgrading mitigates the risk of phishing or state leakage.