Executive brief
Pocket ID, an identity provider, contains a flaw where OIDC refresh tokens remain valid even after a user's access is revoked or their account is disabled by an administrator. This means a former employee or a revoked application could maintain persistent, unauthorized access to sensitive corporate services and personal data for up to 30 days at a time, indefinitely extending this window through token rotation. The 'kill switch' intended to immediately terminate access fails to affect these existing background tokens.
Technical details
The `createTokenFromRefreshToken` function in `oidc_service.go` validates the cryptographic signature and expiration of refresh tokens but fails to verify the current status of the associated user and authorization record. Specifically, it does not check if the `user.Disabled` flag is set, if the `UserAuthorizedOidcClient` record still exists (revocation check), or if the user still meets group membership requirements via `IsUserGroupAllowedToAuthorize`. Because each successful refresh issues a new 30-day token, an attacker with an existing refresh token can maintain perpetual access despite administrative actions. The vulnerability is exacerbated by the fact that `RevokeAuthorizedClient` does not delete associated refresh tokens in the database. A patch is available in version 0.0.0-20260419162744-978ac87deffe.
Affected products
- pocket-id Pocket ID < 0.0.0-20260419162744-978ac87deffe
Timeline
- 2026-04-19: patched: Fix merged into main branch
- 2026-04-26: advisory: GitHub Advisory published