{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-20T06:03:12.586","vulnerabilities":[{"cve":{"id":"CVE-2026-28512","sourceIdentifier":"security-advisories@github.com","published":"2026-03-10T17:38:50.113","lastModified":"2026-03-13T16:12:14.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host. This vulnerability is fixed in 2.4.0."},{"lang":"es","value":"Pocket ID es un proveedor OIDC que permite a los usuarios autenticarse con sus passkeys en sus servicios. Desde la versión 2.0.0 hasta antes de la 2.4.0, un fallo en la validación de la URL de callback permitió que valores de redirect_uri manipulados que contenían información de usuario de URL (@) eludieran las comprobaciones legítimas del patrón de callback. Si un atacante puede engañar a un usuario para que abra un enlace de autorización malicioso, el código de autorización podría ser redirigido a un host controlado por el atacante. Esta vulnerabilidad se corrigió en la versión 2.4.0."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pocket-id:pocket_id:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.4.0","matchCriteriaId":"F0499052-79D0-4301-AB0E-4ABF8299027C"}]}]}],"references":[{"url":"https://github.com/pocket-id/pocket-id/commit/3a339e33191c31b68bf57db907f800d9de5ffbc8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/pocket-id/pocket-id/security/advisories/GHSA-9h33-g3ww-mqff","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory"]}]}}]}