{"items":[{"id":"NVI-00015375","kind":"vulnerability","title":"Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hp74-gm6m-2qm5"],"plain_summary":"GitHub lists this reviewed advisory for github.com/pocket-id/pocket-id/backend. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-623ef4aeff38f13aa734ddcd12bb0a7f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-623ef4aeff38f13aa734ddcd12bb0a7f","url":"https://github.com/advisories/GHSA-hp74-gm6m-2qm5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hp74-gm6m-2qm5","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:59:04.660Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-623ef4aeff38f13aa734ddcd12bb0a7f"],"technology":"github.com/pocket-id/pocket-id/backend","known_exclusions":[],"conditions_summary":"# Reauthentication Bypass via One-Time Access Token Login\n\n## Summary\n\nA weaker authentication method (OTA token or signup token) is accepted as passkey step-up proof, yielding unauthorized renewable 30-day OIDC refresh tokens for clients explicitly configured with `RequiresReauthentication: true`. The `POST /api/webauthn/reauthenticate` endpoint's access-token fallback checks only JWT freshness (`IssuedAt` within 60 seconds), not the authentication method used. The session cookie gate is also non-validating -- any arbitrary cookie value (e.g. `session=deadbeef`) is accepted, collapsing the reauth boundary to token recency alone.\n\nThe bypass needs to succeed only once. The resulting OIDC grant includes a 30-day refresh token that can be rotated indefinitely, providing persistent victim-impersonation access to the protected downstream service. The attacker obtains `access_token` (1-hour TTL), `id_token` (victim's name, email, profile), and `refresh_token` (30-day TTL, renewable) for a client that was explicitly configured to require passkey step-up authentication. The attacker can perform victim-scoped actions at the downstream relying party indefinitely.\n\n## Root Cause\n\n`CreateReau","public_affected_ranges":["< 0.0.0-20260419162744-978ac87deffe"]}],"null_published_at":"2026-11-03T10:03:31.359Z","source_updated_at":"2026-07-28T14:25:30.000Z","source_disclosed_at":"2026-07-28T14:25:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:59:04.660Z"}],"next_cursor":null,"snapshot_revision":"42594"}