HIGH GitHub
CVE-2026-43983
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
# OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions
## Summary
The `createTokenFromRefreshToken` function (oidc_service.go:451) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows three bypasses:
1. **Authorization revocation bypass**: After a user revokes an OIDC client's authorization, the client can continue refreshing tokens indefinite
Affected Products
- go/github.com/pocket-id/pocket-id/backend < 0.0.0-20260419162744-978ac87deffe
References
- https://github.com/advisories/GHSA-w6p7-2fxx-4f44
- https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44
- https://nvd.nist.gov/vuln/detail/CVE-2026-43983
- https://github.com/pocket-id/pocket-id/commit/978ac87deffec58beaccd15aead975e91b94c8a5
This high severity vulnerability was published on 2026-07-28 via GitHub. Affected: go/github.com/pocket-id/pocket-id/backend < 0.0.0-20260419162744-978ac87deffe.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.