Go/github.com/pocket-id/pocket-id/backend CVE-2026-55834: medium 4.3, EPSS 0.37%

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Action: Upgrade github.com/pocket-id/pocket-id/backend to 2.9.0 or later.

go get github.com/pocket-id/pocket-id/backend@v2.9.0

Affected

Fixed versions

Sources

• osv: GHSA-2wvm-8mvp-22qv
• https://github.com/pocket-id/pocket-id/security/advisories/GHSA-2wvm-8mvp-22qv
• https://github.com/pocket-id/pocket-id/commit/8a7577497131229badb35cb4b3a4227b1300afff
• https://github.com/pocket-id/pocket-id
• https://github.com/pocket-id/pocket-id/releases/tag/v2.9.0

CVE-2026-55834 · published 2026-08-28T16:28:20Z · modified 2026-09-02T19:55:44.720187499Z · JSON