Pocket ID reauthentication bypass via JWT freshness check fallback

Executive brief

Pocket ID, a self-hosted identity provider, contains a flaw that allows attackers to bypass required security checks for sensitive services. When a service is configured to require a 'passkey' (a secure physical or biometric key) for extra protection, an attacker with a temporary access token can trick the system into skipping this requirement. This allows the attacker to gain long-term, persistent access to protected corporate applications and data by impersonating a legitimate user.

Technical details

The vulnerability exists in the `POST /api/webauthn/reauthenticate` endpoint, specifically within the `CreateReauthenticationTokenWithAccessToken` function. The application implements a fallback mechanism that validates reauthentication by checking if a JWT's `IssuedAt` claim is less than 60 seconds old, but it fails to verify the `auth_method`. Consequently, tokens generated via weaker methods like One-Time Access (OTA) tokens or initial signups are accepted as valid proof of a WebAuthn ceremony. Additionally, the session cookie check only verifies the presence of a cookie named 'session' without validating its value against a server-side store. An attacker with a fresh OTA token can obtain a reauthentication token to authorize OIDC clients configured with `RequiresReauthentication: true`, granting them renewable 30-day refresh tokens.

Affected products

• pocket-id Pocket ID < 0.0.0-20260419162744-978ac87deffe

Timeline

• 2026-04-19: patched: Fixed in commit 978ac87deffe
• 2026-04-26: advisory

References

• https://api.github.com/users/kodareef5
• https://github.com/kodareef5
• https://api.github.com/users/kodareef5/gists%7B/gist_id%7D
• https://api.github.com/users/kodareef5/repos
• https://avatars.githubusercontent.com/u/261977334?v=4
• https://api.github.com/users/kodareef5/events%7B/privacy%7D