- Severity: CRITICAL
- CVE: CVE-2026-115770
- Ecosystems: go
- Packages: github.com/pocket-id/pocket-id/backend
## Summary
An authenticated Pocket ID user can request an email-verification token while their account uses an address they control, change the account email address, and then redeem the previously issued token. The token is bound only to the user ID, not to the address to which it was sent, and changing the address does not revoke outstanding tokens.
As a result, Pocket ID marks the newly supplied address as verified even though the user never proved control of it. Pocket ID subsequently returns that address with `email_verified: true` in OIDC claims. A relying party that trusts this claim for email-based account linking or provisioning can therefore link the attacker’s Pocket ID identity to a victim’s existing account, leading to cross-application account takeover.
This was verified against commit `9f559788a44cfea790de360da0a74d4bdf8ca5d5`.
## Preconditions
– The attacker has an ordinary Pocket ID user account.
– Email verification is in use (`emailsVerified=false`, which is the default).
– The user can edit their own account (`allowOwnAccountEdit=true`, which is the default).
– The target address is not already assigned to another Pocket ID user.
– For downstream account takeover, a relying party links or provisions users based on a trusted, verified email address. Applications that rely exclusively on the stable OIDC `sub` claim are not affected by that downstream consequence.
No administrator privilege, victim interaction, or access to the victim’s mailbox is requi…
Source: GitHub Security Advisories · 2026-11-09