Detections
Analytics

SCA: security update for github.com/pocket-id/pocket-id/backend (GHSA-hp74-gm6m-2qm5)

high Tenable Cloud Security Plugin ID 445411

Description

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Solution

Update the github.com/pocket-id/pocket-id/backend library and its related packages to version 0.0.0-20260419162744-978ac87deffe or later.

See Also

https://github.com/advisories/GHSA-hp74-gm6m-2qm5

Plugin Details

Severity: High

ID: 445411

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 7/28/2026

Updated: 7/28/2026

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/28/2026

Vulnerability Publication Date: 7/28/2026

Reference Information

cwe: CWE-287