Is CVE-2026-62662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62662 being exploited in the wild.

How severe is CVE-2026-62662?

High severity, with a CVSS score of 7.7, published 4 November 2026.

Which products and versions are affected?

github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260622164202-8158452b3730, SEMVER:introduced=0,fixed=0.0.0-20260622164202-8158452b3730; Pocket-Id Pocket Id 1.11.0 to 2.9.x.

Is there a fix for CVE-2026-62662?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260622164202-8158452b3730 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62662 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-62662?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62662: Pocket ID OIDC audience validation bypass

Q: Is there a fix for CVE-2026-62662?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260622164202-8158452b3730 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62662 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-62662?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62662 · Severity: high · CVSS 7.7 · Published 2026-11-04

Pocket ID is an identity provider that uses passkeys to authenticate users to applications. A vulnerability in versions 1.11.0 through 2.9.x allows any authenticated client to forge access tokens with arbitrary audiences, bypassing authorization controls. In systems that rely on these tokens to authorize service-to-service requests, attackers can gain unauthorized access to data or functionality.

Technologies: github.com/pocket-id/pocket-id/backend (Go), Pocket-Id Pocket Id. Vendors: Go, Pocket-Id.

Quick answers

Is CVE-2026-62662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62662 being exploited in the wild.
How severe is CVE-2026-62662?: High severity, with a CVSS score of 7.7, published 4 November 2026.
Which products and versions are affected?: github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260622164202-8158452b3730, SEMVER:introduced=0,fixed=0.0.0-20260622164202-8158452b3730; Pocket-Id Pocket Id 1.11.0 to 2.9.x.
Is there a fix for CVE-2026-62662?: Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260622164202-8158452b3730 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62662 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-62662?: Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260622164202-8158452b3730 or later
```
go get github.com/pocket-id/pocket-id/backend@v0.0.0-20260622164202-8158452b3730
```

Technical details

The createTokenFromClientCredentials function in the OIDC service accepts a client-supplied resource parameter and embeds it directly into the access token's aud (audience) claim without validation. An authenticated client can create tokens claiming to represent any other client or arbitrary audience; the /api/oidc/introspect endpoint accepts these forged tokens if the introspecting client matches the attacker-chosen audience. The attack requires OIDC client authentication but bypasses audience-based authorization intended for service-to-service trust relationships.

Affected products

Pocket ID Pocket ID 1.11.0 to 2.9.x

Identifiers

CVE-2026-62662
GHSA-q4xm-p75h-h9p3

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.