Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115770— Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

Quick assessment

Affected
pocket-id pocket-id
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pocket ID 是一个 OIDC（开放身份连接）提供商，允许用户使用其通行密钥（passkeys）对各类服务进行身份验证。在版本 2.2.0 至 2.12.0 期间， 函数使用 中的令牌模型，将邮箱验证令牌仅绑定到用户标识符（user ID）。然而， 函数允许用户更改账户邮箱地址，而不会使尚未使用的验证令牌失效；随后， 函数会将当前邮箱地址标记为已验证。 因此，普通用户可以执行以下操作：首先，为其控制的某个邮箱地址请求一个验证令牌；接着，将账户邮箱更改为任意未被占用的邮箱地址；最后，使用之前获取的旧令牌完成验证

CVSS 9.6 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115770

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
Source: CVE Program / CVE List V5
Vulnerability Description
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the new address with email_verified set to true. The default affected configuration uses emailsVerified=false and allowOwnAccountEdit=true; the target address must not already belong to another Pocket ID user. A relying application that trusts a verified email for automatic account matching or provisioning can link the attacker's identity to another user's account, while applications that rely exclusively on the stable OIDC sub claim are not affected by that downstream consequence. This issue is fixed in version 2.12.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pocket-id pocket-id >= 2.2.0, < 2.12.0 -

II. Public POCs for CVE-2026-115770

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115770

请登录查看更多情报信息。

Other References for CVE-2026-115770 (4)

IV. Related Vulnerabilities

Same product: pocket-id
Same vendor: pocket-id
Same weakness: CWE-345