Is CVE-2026-43983 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43983 being exploited in the wild.

How severe is CVE-2026-43983?

High severity, with a CVSS score of 8.1, published 12 May 2026.

Which products and versions are affected?

github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260419162744-978ac87deffe, SEMVER:introduced=0,fixed=0.0.0-20260419162744-978ac87deffe; Pocket-Id Pocket Id < 0.0.0-20260419162744-978ac87deffe, < 2.6.0.

Is there a fix for CVE-2026-43983?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260419162744-978ac87deffe or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43983 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-43983?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43983: Pocket ID improper authorization in OIDC refresh token flow

Q: Is there a fix for CVE-2026-43983?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260419162744-978ac87deffe or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-43983 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-43983?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43983 · Severity: high · CVSS 8.1 · Published 2026-05-12

Pocket ID, an identity provider, contains a flaw where OIDC refresh tokens remain valid even after a user's access is revoked or their account is disabled by an administrator. This means a former employee or a revoked application could maintain persistent, unauthorized access to sensitive corporate services and personal data for up to 30 days at a time, indefinitely extending this window through token rotation. The 'kill switch' intended to immediately terminate access fails to affect these existing background tokens.

Technologies: github.com/pocket-id/pocket-id/backend (Go), Pocket-Id Pocket Id. Vendors: Go, Pocket-Id.

Quick answers

Is CVE-2026-43983 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43983 being exploited in the wild.
How severe is CVE-2026-43983?: High severity, with a CVSS score of 8.1, published 12 May 2026.
Which products and versions are affected?: github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260419162744-978ac87deffe, SEMVER:introduced=0,fixed=0.0.0-20260419162744-978ac87deffe; Pocket-Id Pocket Id < 0.0.0-20260419162744-978ac87deffe, < 2.6.0.
Is there a fix for CVE-2026-43983?: Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260419162744-978ac87deffe or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43983 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-43983?: Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260419162744-978ac87deffe or later
```
go get github.com/pocket-id/pocket-id/backend@v0.0.0-20260419162744-978ac87deffe
```

Technical details

The `createTokenFromRefreshToken` function in `oidc_service.go` validates the cryptographic signature and expiration of refresh tokens but fails to verify the current status of the associated user and authorization record. Specifically, it does not check if the `user.Disabled` flag is set, if the `UserAuthorizedOidcClient` record still exists (revocation check), or if the user still meets group membership requirements via `IsUserGroupAllowedToAuthorize`. Because each successful refresh issues a new 30-day token, an attacker with an existing refresh token can maintain perpetual access despite administrative actions. The vulnerability is exacerbated by the fact that `RevokeAuthorizedClient` does not delete associated refresh tokens in the database. A patch is available in version 0.0.0-20260419162744-978ac87deffe.

Affected products

pocket-id Pocket ID < 0.0.0-20260419162744-978ac87deffe

Identifiers

CVE-2026-43983
GHSA-w6p7-2fxx-4f44
GO-2026-6119

Timeline

2026-04-19: patched: Fix merged into main branch
2026-04-26: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.