Pocket ID, an OpenID Connect (OIDC) provider for passkey authentication, contains a vulnerability in versions prior to 2.4.0. The OIDC token endpoint improperly validates authorization codes, only rejecting them when both the client ID is wrong AND the code is expired. This flaw allows attackers to perform cross-client code exchange and reuse expired authorization codes. The vulnerability enables unauthorized access across different clients and extends the lifespan of expired tokens. This issue has been patched in version 2.4.0 of Pocket ID.