CVE-2026-28512

{"id": "CVE-2026-28512", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-03-10T17:38:50.113", "references": [{"url": "https://github.com/pocket-id/pocket-id/commit/3a339e33191c31b68bf57db907f800d9de5ffbc8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-9h33-g3ww-mqff", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0."}, {"lang": "es", "value": "Pocket ID es un proveedor OIDC que permite a los usuarios autenticarse con sus passkeys en sus servicios. Desde la versi\u00f3n 2.0.0 hasta antes de la 2.4.0, un fallo en la validaci\u00f3n de la URL de callback permiti\u00f3 que valores de redirect_uri manipulados que conten\u00edan informaci\u00f3n de usuario de URL (@) eludieran las comprobaciones leg\u00edtimas del patr\u00f3n de callback. Si un atacante puede enga\u00f1ar a un usuario para que abra un enlace de autorizaci\u00f3n malicioso, el c\u00f3digo de autorizaci\u00f3n podr\u00eda ser redirigido a un host controlado por el atacante. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 2.4.0."}], "lastModified": "2026-03-13T16:12:14.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0499052-79D0-4301-AB0E-4ABF8299027C", "versionEndExcluding": "2.4.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}