Executive brief
Pocket-ID is an identity provider (IdP) that handles user authentication and authorization. When a user clicks a specially crafted authorization link with prompt=none, the application redirects them to an attacker's website without validating that the URL is legitimate. An attacker can exploit this to conduct credential phishing (by leveraging the victim's trust in the IdP domain) or steal sensitive authentication error codes, causing users to leak information to untrusted sites.
Technical details
This is an open redirect vulnerability (CWE-601) in the OIDC /authorize endpoint of Pocket-ID's SvelteKit frontend. The vulnerability occurs when an authorization request includes prompt=none and the user cannot be silently authenticated. The frontend at frontend/src/routes/authorize/+page.svelte parses the redirect_uri query parameter and directly uses it in a window.location.href redirect without consulting the backend's GetCallbackURLFromList validator, which enforces a per-client allow-list of valid redirect URLs. While basic URL scheme filtering (blocking javascript: and data: URLs) is applied, any http: or https: origin passes through. An unauthenticated attacker with knowledge of a client_id (obtainable from public metadata endpoints) can craft an authorization URL that redirects victims to attacker-controlled endpoints, enabling phishing and OAuth response parameter leakage. The standard interactive flow (without prompt=none) correctly validates against the backend allow-list before redirecting. A second attack variant exists when an authenticated victim attempts first-time authorization of a client. The fix is available in version 2.9.0.
Affected products
- Pocket-ID Pocket-ID >= 2.6.0, <= 2.8.0
Timeline
- 2026-08-28: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-16: patched: Patch released in version 2.9.0