Is CVE-2026-55834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55834 being exploited in the wild.

How severe is CVE-2026-55834?

Medium severity, with a CVSS score of 4.3, published 28 August 2026.

Which products and versions are affected?

github.com/pocket-id/pocket-id/backend (Go) >= 2.6.0, <= 2.8.0, SEMVER:introduced=0, SEMVER:introduced=2.6.0,fixed=2.9.0.

Is there a fix for CVE-2026-55834?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55834 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55834?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55834: Pocket-ID open redirect in OIDC authorize page with prompt=none

Q: Is there a fix for CVE-2026-55834?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55834 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55834?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55834 · Severity: medium · CVSS 4.3 · Published 2026-08-28

Pocket-ID is an identity provider (IdP) that handles user authentication and authorization. When a user clicks a specially crafted authorization link with prompt=none, the application redirects them to an attacker's website without validating that the URL is legitimate. An attacker can exploit this to conduct credential phishing (by leveraging the victim's trust in the IdP domain) or steal sensitive authentication error codes, causing users to leak information to untrusted sites.

Technologies: github.com/pocket-id/pocket-id/backend (Go). Vendors: Go.

Quick answers

Is CVE-2026-55834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55834 being exploited in the wild.
How severe is CVE-2026-55834?: Medium severity, with a CVSS score of 4.3, published 28 August 2026.
Which products and versions are affected?: github.com/pocket-id/pocket-id/backend (Go) >= 2.6.0, <= 2.8.0, SEMVER:introduced=0, SEMVER:introduced=2.6.0,fixed=2.9.0.
Is there a fix for CVE-2026-55834?: Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55834 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55834?: Check whether you run github.com/pocket-id/pocket-id/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/pocket-id/pocket-id/backend (Go): upgrade to 2.9.0 or later
```
go get github.com/pocket-id/pocket-id/backend@v2.9.0
```

Technical details

This is an open redirect vulnerability (CWE-601) in the OIDC /authorize endpoint of Pocket-ID's SvelteKit frontend. The vulnerability occurs when an authorization request includes prompt=none and the user cannot be silently authenticated. The frontend at frontend/src/routes/authorize/+page.svelte parses the redirect_uri query parameter and directly uses it in a window.location.href redirect without consulting the backend's GetCallbackURLFromList validator, which enforces a per-client allow-list of valid redirect URLs. While basic URL scheme filtering (blocking javascript: and data: URLs) is applied, any http: or https: origin passes through. An unauthenticated attacker with knowledge of a client_id (obtainable from public metadata endpoints) can craft an authorization URL that redirects victims to attacker-controlled endpoints, enabling phishing and OAuth response parameter leakage. The standard interactive flow (without prompt=none) correctly validates against the backend allow-list before redirecting. A second attack variant exists when an authenticated victim attempts first-time authorization of a client. The fix is available in version 2.9.0.

Affected products

Pocket-ID Pocket-ID >= 2.6.0, <= 2.8.0

Identifiers

CVE-2026-55834
GHSA-2wvm-8mvp-22qv
GO-2026-6305

Timeline

2026-08-28: disclosed: Vulnerability published to GitHub Advisory Database
2026-06-16: patched: Patch released in version 2.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.