Pocket ID client credentials flow issues tokens for arbitrary audiences
Attackers can secretly get other services' passes from a passkey login server.
Summary
Pocket ID is an OIDC login server that lets users sign in to services with passkeys. Any authenticated OIDC client can obtain a Pocket ID-signed token for another client or an arbitrary audience, which bypasses audience-based access controls where resource servers trust these tokens for service-to-service authorization.
Affected when
- Resource servers trust Pocket ID access tokens for service-to-service authorization
- Attacker holds an authenticated OIDC client
What to do
Update to version 2.10.0. Versions from 1.11.0 up to 2.10.0 are affected. If you cannot update yet, check whether your services use Pocket ID access tokens for service-to-service authorization.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen