Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authori…

Pocket ID, an OpenID Connect (OIDC) provider for passkey authentication, contains a vulnerability in versions prior to 2.4.0. The OIDC token endpoint improperly validates authorization codes, only rejecting them when both the client ID is wrong AND the code is expired. This flaw allows attackers to perform cross-client code exchange and reuse expired authorization codes. The vulnerability enables unauthorized access across different clients and extends the lifespan of expired tokens. This issue has been patched in version 2.4.0 of Pocket ID.