Pocket ID Verified-Email Spoofing Flaw (CVE-2026-115770)

CVE-2026-115770 is a flaw in how Pocket ID, an OIDC provider that signs users in with passkeys, verifies email addresses. A verification token is tied only to the user's identifier, not to the address it was sent to. Changing the account email does not cancel a token that is already outstanding.

An ordinary user can request a token for an address they control, then change the account to an address they do not control. Redeeming the old token makes Pocket ID mark the new address as verified. Pocket ID then publishes that address with email_verified set to true in its OIDC claims.

Why a False Verified Email Matters

The damage lands in the applications that trust Pocket ID. The advisory says a relying application that uses a verified email for automatic account matching or provisioning can link the attacker's identity to another user's account. That is an account takeover in the downstream app, not in Pocket ID itself.

Applications that rely only on the stable OIDC sub claim are not affected by that downstream consequence. The advisory also says no administrator privilege, victim interaction or access to the victim's mailbox is needed. The target address must not already belong to another Pocket ID user.

Preconditions in the Default Setup

The CVE record says the default affected configuration uses emailsVerified=false and allowOwnAccountEdit=true. The attacker needs an ordinary account on the instance. This is why the CNA scores it with low privileges required and a changed scope, because the impact reaches other applications.

Root Cause and the Fix

According to the advisory, the token record stores only a token, an expiry and a user ID. The update function resets the verified flag when the address changes but leaves existing tokens valid. The verify function checks only the token, user ID and expiry, and the claims service publishes the current address with the current flag.

Pocket ID fixed the issue in version 2.12.0. The advisory suggests binding each token to the normalized target address and invalidating outstanding tokens when the email changes. The CVE record links the fix pull request and commit, so reviewers can read the change.

What CVSS and CISA KEV Say

GitHub, the CNA, scores the flaw CVSS 3.1 9.6 Critical with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. NVD lists the score as secondary and received the entry on 4 November 2026. There is no CVSS 4.0 score in the record or NVD.

As of CISA catalog version 2026.11.04, the CVE is not in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog.

The CVE record lists Pocket ID from 2.2.0 up to but not including 2.12.0, and names version 2.12.0 as the fix. GitHub's advisory lists the Go module github.com/pocket-id/pocket-id/backend with the same range. Version 2.12.0 was released on 29 July 2026, according to the GitHub release page.

GitHub's release list also shows later versions, such as 2.19.2 dated 2 November 2026. We recommend moving to the newest release rather than stopping at 2.12.0. The 2.12.0 release notes say the version includes security fixes and that updating is highly recommended.

The record does not name versions before 2.2.0 as affected. Our vulnerability management guide covers how to track self-hosted services like this one.