# Pocket ID reauthentication bypass via JWT freshness check fallback

Source: https://junglewise.ai/threats/pocket-id-reauthentication-bypass-via-jwt-freshness-check-fallback-515ed392  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.8 · Published 2026-07-28

Pocket ID, a self-hosted identity provider, contains a flaw that allows attackers to bypass required security checks for sensitive services. When a service is configured to require a 'passkey' (a secure physical or biometric key) for extra protection, an attacker with a temporary access token can trick the system into skipping this requirement. This allows the attacker to gain long-term, persistent access to protected corporate applications and data by impersonating a legitimate user.

Technologies: [github.com/pocket-id/pocket-id/backend (Go)](https://junglewise.ai/threats/technologies/github-com-pocket-id-pocket-id-backend), [Pocket-Id Pocket Id](https://junglewise.ai/threats/technologies/pocket-id). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Pocket-Id](https://junglewise.ai/threats/vendors/pocket-id).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.8, published 28 July 2026.

**Which products and versions are affected?** github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260419162744-978ac87deffe; Pocket-Id Pocket Id < 0.0.0-20260419162744-978ac87deffe.

**Is there a fix for This vulnerability?** A patch was published on 2026-04-19: Fixed in commit 978ac87deffe Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a hosted service.

**Am I affected?** Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `POST /api/webauthn/reauthenticate` endpoint, specifically within the `CreateReauthenticationTokenWithAccessToken` function. The application implements a fallback mechanism that validates reauthentication by checking if a JWT's `IssuedAt` claim is less than 60 seconds old, but it fails to verify the `auth_method`. Consequently, tokens generated via weaker methods like One-Time Access (OTA) tokens or initial signups are accepted as valid proof of a WebAuthn ceremony. Additionally, the session cookie check only verifies the presence of a cookie named 'session' without validating its value against a server-side store. An attacker with a fresh OTA token can obtain a reauthentication token to authorize OIDC clients configured with `RequiresReauthentication: true`, granting them renewable 30-day refresh tokens.

## Affected products

- pocket-id Pocket ID < 0.0.0-20260419162744-978ac87deffe

## Timeline

- 2026-04-19: patched: Fixed in commit 978ac87deffe
- 2026-04-26: advisory

## References

- [https://api.github.com/users/kodareef5](https://api.github.com/users/kodareef5)
- [https://github.com/kodareef5](https://github.com/kodareef5)
- [https://api.github.com/users/kodareef5/gists%7B/gist_id%7D](https://api.github.com/users/kodareef5/gists%7B/gist_id%7D)
- [https://api.github.com/users/kodareef5/repos](https://api.github.com/users/kodareef5/repos)
- [https://avatars.githubusercontent.com/u/261977334?v=4](https://avatars.githubusercontent.com/u/261977334?v=4)
- [https://api.github.com/users/kodareef5/events%7B/privacy%7D](https://api.github.com/users/kodareef5/events%7B/privacy%7D)

## Related threats

- [Pocket ID OIDC audience validation bypass](https://junglewise.ai/threats/cve-2026-62662-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate)
- [Pocket ID email verification token privilege escalation](https://junglewise.ai/threats/cve-2026-115770-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate)
- [Pocket-ID open redirect in OIDC authorize page with prompt=none](https://junglewise.ai/threats/cve-2026-55834-pocket-id-open-redirect-in-oidc-authorize-page-with-prompt-none)
- [GO-2026-6117 - Pocket ID has a reauthentication bypass via one-time access token login , passkey step-up requirement…](https://junglewise.ai/threats/go-2026-6117-pocket-id-has-a-reauthentication-bypass-via-one-time-97f49b16)
- [Pocket ID improper authorization in OIDC refresh token flow](https://junglewise.ai/threats/cve-2026-43983-pocket-id-improper-authorization-in-oidc-refresh-token-flow)