---
id: CVE-2026-62662
title: >-
  Pocket ID: Client credentials grant allows any OIDC client to obtain tokens
  for arbitrary audiences
summary: >-
  Pocket ID is an OIDC provider that allows users to authenticate with their
  passkeys to services. From 1.11.0 until 2.10.0,
  createTokenFromClientCredentials in backend/internal/service/oidc_service.go
  accepts the client-controlled resourc…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-20
  - CWE-863
vendor: pocket-id
product: pocket-id
affected:
  - 'pocket-id >= 1.11.0, < 2.10.0'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:29:36.917Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62662'
references:
  - url: >-
      https://github.com/pocket-id/pocket-id/security/advisories/GHSA-q4xm-p75h-h9p3
    label: >-
      https://github.com/pocket-id/pocket-id/security/advisories/GHSA-q4xm-p75h-h9p3
  - url: 'https://github.com/pocket-id/pocket-id/pull/1520'
    label: 'https://github.com/pocket-id/pocket-id/pull/1520'
  - url: >-
      https://github.com/pocket-id/pocket-id/commit/8158452b37304115c97c61c3a56082ce938ce6f0
    label: >-
      https://github.com/pocket-id/pocket-id/commit/8158452b37304115c97c61c3a56082ce938ce6f0
  - url: 'https://github.com/pocket-id/pocket-id/releases/tag/v2.10.0'
    label: 'https://github.com/pocket-id/pocket-id/releases/tag/v2.10.0'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.649Z'
---

## Overview

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds it directly in the access token aud claim without validating that the audience is registered or that the requesting client may access it. Any authenticated OIDC client can therefore obtain a Pocket ID-signed token naming another client or an arbitrary audience. The /api/oidc/introspect endpoint cannot distinguish the unauthorized token because it treats a token as active when the introspecting client's identifier matches the attacker-selected audience. In deployments where resource servers trust Pocket ID access tokens for service-to-service authorization, this bypasses audience-based access controls and can permit unauthorized data access or actions; deployments that do not use these tokens for resource-server authorization have no immediate exploitable impact. This issue is fixed in version 2.10.0.

## Affected

- `pocket-id >= 1.11.0, < 2.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.