Pocket ID: verification token survives email change, spoofing verified emails (CVE-2026-115770)
Severity: critical · Patch status: patched · Since 2026-07-29 · CVE-2026-115770
Pocket ID is an open-source passkey-based OIDC provider (BSD-2-Clause, about 10.2K GitHub stars; Docker Hub repository pocketid/pocket-id shows about 811K lifetime pulls across tags). Its email-verification tokens were bound only to the user ID, not to the address they were sent to, and changing the account email did not revoke outstanding tokens. With default settings (emailsVerified=false, allowOwnAccountEdit=true), an ordinary user can request a token for an address they control, switch the account to an unused victim address, redeem the old token, and receive the victim address with emailverified true in OIDC claims. Relying parties that link or provision accounts by verified email can then merge the attacker's identity with a victim's account. Releases from v2.2.0 through v2.11.x are affected. The fix merged 2026-07-27 and shipped in v2.12.0 on 2026-07-29. The advisory includes an executable proof of concept. No in-the-wild exploitation is reported in the sources reviewed, the CVE is not in CISA KEV, and its EPSS is 0.00166.
What to do
- Upgrade Pocket ID to v2.12.0 or later (latest release v2.19.2, 2026-11-02)
- Audit relying-party apps for email-based account linking or provisioning, and prefer the stable OIDC sub claim
- Review accounts with emailVerified=true whose address changed while verified, for signs of abuse
- Until upgraded, consider setting allowOwnAccountEdit to false
Fixed versions
Sources
All live incidents on Threat Watch
