# CVE-2026-62662: Pocket ID OIDC audience validation bypass

Source: https://junglewise.ai/threats/cve-2026-62662-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-62662 · Severity: high · CVSS 7.7 · Published 2026-11-04

Pocket ID is an identity provider that uses passkeys to authenticate users to applications. A vulnerability in versions 1.11.0 through 2.9.x allows any authenticated client to forge access tokens with arbitrary audiences, bypassing authorization controls. In systems that rely on these tokens to authorize service-to-service requests, attackers can gain unauthorized access to data or functionality.

Technologies: [github.com/pocket-id/pocket-id/backend (Go)](https://junglewise.ai/threats/technologies/github-com-pocket-id-pocket-id-backend), [Pocket-Id Pocket Id](https://junglewise.ai/threats/technologies/pocket-id). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Pocket-Id](https://junglewise.ai/threats/vendors/pocket-id).

## Quick answers

**Is CVE-2026-62662 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62662 being exploited in the wild.

**How severe is CVE-2026-62662?** High severity, with a CVSS score of 7.7, published 4 November 2026.

**Which products and versions are affected?** github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260622164202-8158452b3730, SEMVER:introduced=0,fixed=0.0.0-20260622164202-8158452b3730; Pocket-Id Pocket Id 1.11.0 to 2.9.x.

**Is there a fix for CVE-2026-62662?** Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260622164202-8158452b3730 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62662 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-62662?** Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260622164202-8158452b3730 or later

  ```sh
  go get github.com/pocket-id/pocket-id/backend@v0.0.0-20260622164202-8158452b3730
  ```


## Technical details

The createTokenFromClientCredentials function in the OIDC service accepts a client-supplied resource parameter and embeds it directly into the access token's aud (audience) claim without validation. An authenticated client can create tokens claiming to represent any other client or arbitrary audience; the /api/oidc/introspect endpoint accepts these forged tokens if the introspecting client matches the attacker-chosen audience. The attack requires OIDC client authentication but bypasses audience-based authorization intended for service-to-service trust relationships.

## Affected products

- Pocket ID Pocket ID 1.11.0 to 2.9.x

## Identifiers

- CVE-2026-62662
- GHSA-q4xm-p75h-h9p3

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/pocket-id/pocket-id/commit/8158452b37304115c97c61c3a56082ce938ce6f0](https://github.com/pocket-id/pocket-id/commit/8158452b37304115c97c61c3a56082ce938ce6f0)
- [https://github.com/pocket-id/pocket-id/pull/1520](https://github.com/pocket-id/pocket-id/pull/1520)

## Related threats

- [Pocket ID email verification token privilege escalation](https://junglewise.ai/threats/cve-2026-115770-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate)
- [Pocket-ID open redirect in OIDC authorize page with prompt=none](https://junglewise.ai/threats/cve-2026-55834-pocket-id-open-redirect-in-oidc-authorize-page-with-prompt-none)
- [GO-2026-6117 - Pocket ID has a reauthentication bypass via one-time access token login , passkey step-up requirement…](https://junglewise.ai/threats/go-2026-6117-pocket-id-has-a-reauthentication-bypass-via-one-time-97f49b16)
- [Pocket ID reauthentication bypass via JWT freshness check fallback](https://junglewise.ai/threats/pocket-id-reauthentication-bypass-via-jwt-freshness-check-fallback-515ed392)
- [Pocket ID improper authorization in OIDC refresh token flow](https://junglewise.ai/threats/cve-2026-43983-pocket-id-improper-authorization-in-oidc-refresh-token-flow)