# CVE-2026-55834: Pocket-ID open redirect in OIDC authorize page with prompt=none

Source: https://junglewise.ai/threats/cve-2026-55834-pocket-id-open-redirect-in-oidc-authorize-page-with-prompt-none  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55834 · Severity: medium · CVSS 4.3 · Published 2026-08-28

Pocket-ID is an identity provider (IdP) that handles user authentication and authorization. When a user clicks a specially crafted authorization link with prompt=none, the application redirects them to an attacker's website without validating that the URL is legitimate. An attacker can exploit this to conduct credential phishing (by leveraging the victim's trust in the IdP domain) or steal sensitive authentication error codes, causing users to leak information to untrusted sites.

Technologies: [github.com/pocket-id/pocket-id/backend (Go)](https://junglewise.ai/threats/technologies/github-com-pocket-id-pocket-id-backend). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55834 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55834 being exploited in the wild.

**How severe is CVE-2026-55834?** Medium severity, with a CVSS score of 4.3, published 28 August 2026.

**Which products and versions are affected?** github.com/pocket-id/pocket-id/backend (Go) >= 2.6.0, <= 2.8.0, SEMVER:introduced=0, SEMVER:introduced=2.6.0,fixed=2.9.0.

**Is there a fix for CVE-2026-55834?** Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55834 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55834?** Check whether you run github.com/pocket-id/pocket-id/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/pocket-id/pocket-id/backend (Go): upgrade to 2.9.0 or later

  ```sh
  go get github.com/pocket-id/pocket-id/backend@v2.9.0
  ```


## Technical details

This is an open redirect vulnerability (CWE-601) in the OIDC /authorize endpoint of Pocket-ID's SvelteKit frontend. The vulnerability occurs when an authorization request includes prompt=none and the user cannot be silently authenticated. The frontend at frontend/src/routes/authorize/+page.svelte parses the redirect_uri query parameter and directly uses it in a window.location.href redirect without consulting the backend's GetCallbackURLFromList validator, which enforces a per-client allow-list of valid redirect URLs. While basic URL scheme filtering (blocking javascript: and data: URLs) is applied, any http: or https: origin passes through. An unauthenticated attacker with knowledge of a client_id (obtainable from public metadata endpoints) can craft an authorization URL that redirects victims to attacker-controlled endpoints, enabling phishing and OAuth response parameter leakage. The standard interactive flow (without prompt=none) correctly validates against the backend allow-list before redirecting. A second attack variant exists when an authenticated victim attempts first-time authorization of a client. The fix is available in version 2.9.0.

## Affected products

- Pocket-ID Pocket-ID >= 2.6.0, <= 2.8.0

## Identifiers

- CVE-2026-55834
- GHSA-2wvm-8mvp-22qv
- GO-2026-6305

## Timeline

- 2026-08-28: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-16: patched: Patch released in version 2.9.0

## References

- [https://api.github.com/users/geo-chen](https://api.github.com/users/geo-chen)
- [https://github.com/geo-chen](https://github.com/geo-chen)
- [https://api.github.com/users/geo-chen/gists%7B/gist_id%7D](https://api.github.com/users/geo-chen/gists%7B/gist_id%7D)
- [https://api.github.com/users/geo-chen/repos](https://api.github.com/users/geo-chen/repos)
- [https://avatars.githubusercontent.com/u/2404584?v=4](https://avatars.githubusercontent.com/u/2404584?v=4)
- [https://api.github.com/users/geo-chen/events%7B/privacy%7D](https://api.github.com/users/geo-chen/events%7B/privacy%7D)

## Related threats

- [Pocket ID OIDC audience validation bypass](https://junglewise.ai/threats/cve-2026-62662-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate)
- [Pocket ID email verification token privilege escalation](https://junglewise.ai/threats/cve-2026-115770-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate)
- [GO-2026-6117 - Pocket ID has a reauthentication bypass via one-time access token login , passkey step-up requirement…](https://junglewise.ai/threats/go-2026-6117-pocket-id-has-a-reauthentication-bypass-via-one-time-97f49b16)
- [Pocket ID reauthentication bypass via JWT freshness check fallback](https://junglewise.ai/threats/pocket-id-reauthentication-bypass-via-jwt-freshness-check-fallback-515ed392)
- [Pocket ID improper authorization in OIDC refresh token flow](https://junglewise.ai/threats/cve-2026-43983-pocket-id-improper-authorization-in-oidc-refresh-token-flow)