A high-severity authorization vulnerability in Pocket ID allows unauthorized access via cross-client code exchange and the reuse of expired authentication codes.

This is an incorrect authorization flaw (CWE-863) where the OIDC token endpoint fails to properly validate authorization codes, allowing authenticated users to perform cross-client exchanges or reuse expired codes.

With a CVSS score of 8.5, this vulnerability represents a significant risk to identity and access management security. Successful exploitation could allow an attacker to hijack user sessions or bypass intended access controls across services integrated with the Pocket ID provider, potentially leading to unauthorized data access and a compromise of user trust.

Immediate Action: Update Pocket ID to version 2.4.0 or the specified fixed commit version (b59e35cb59ae) immediately to remediate the authorization logic error.

Proactive Monitoring: Review OIDC token endpoint logs for unusual patterns, such as multiple attempts to use the same authorization code or tokens originating from unexpected client IDs.

Compensating Controls: Ensure that downstream services strictly validate the audience (aud) and client ID claims within OIDC tokens to mitigate the risk of cross-client exchange until the provider is patched.

Public Exploit Available: No

Given the critical role of OIDC providers in maintaining organizational security, this vulnerability must be addressed as a high priority. Administrators should apply the 2.4.0 update immediately to prevent potential session hijacking and unauthorized access. Failure to patch may expose integrated applications to identity-based attacks that are difficult to detect without robust centralized logging.