CVE-2026-115770: Email Verification Bypass and Downstream Account Takeover in Pocket ID

Vulnerability ID: CVE-2026-115770
CVSS Score: 9.6
Published: 2026-11-09

CVE-2026-115770 is a critical vulnerability (CVSS 9.6) in Pocket ID, an OpenID Connect (OIDC) provider that uses passkey authentication. In versions 2.2.0 through 2.11.0, email verification tokens are bound exclusively to the user account identifier (user_id) rather than the specific email address for which the token was issued. In addition, updating the account email address does not invalidate existing verification tokens. An authenticated user can request a verification token for an attacker-controlled address, modify their profile email to an arbitrary unverified target address, and redeem the previously issued token. This marks the target email address as verified (email_verified = true), enabling account takeover on downstream OIDC relying parties that link or provision accounts based on verified email claims.

TL;DR

Pocket ID versions 2.2.0 to 2.11.0 bind email verification tokens only to a user ID rather than the specific email address being verified, and fail to revoke tokens when a user changes their email. An authenticated attacker can request a token for their own email, change their account email to a victim's address, and redeem the token to forge a verified email claim (email_verified = true), leading to account takeover on connected OIDC client applications.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-115770 (GHSA-rm8c-2cv8-jwf6)
• Vulnerability Class: CWE-345: Insufficient Verification of Data Authenticity
• CVSS v3.1 Score: 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
• EPSS Score: 0.17% (5.94th percentile)
• Affected Versions: Pocket ID >= 2.2.0, < 2.12.0
• Patched Version: Pocket ID 2.12.0
• Primary Impact: Arbitrary email verification bypass leading to downstream OIDC account takeover
• CISA KEV Status: Not Listed

Affected Systems

• Pocket ID (pocket-id/pocket-id)
• Pocket ID: >= 2.2.0, < 2.12.0 (Fixed in: 2.12.0)

Code Analysis

Commit: 43aaccd

Refactor email verification to use Francis actor state binding token hash to both user ID and email address (PR #1625).

Exploit Details

• GitHub Security Advisory: Official GitHub Security Advisory containing detailed step-by-step reproduction instructions and API workflow to trigger the email verification bypass.

Mitigation Strategies

• Upgrade Pocket ID to version 2.12.0 or later to enforce strict binding between verification tokens and the specific email address requested.
• Disable self-service account editing (allowOwnAccountEdit = false) if immediate patching is not feasible.
• Configure downstream OIDC relying parties to map and link user accounts exclusively via the immutable 'sub' (Subject) claim rather than the 'email' claim.
• Audit existing user records in Pocket ID for unauthorized email address claims that were verified prior to applying the patch.

Remediation Steps:

1. Pull and deploy the official Pocket ID v2.12.0 release container or binary (https://github.com/pocket-id/pocket-id/releases/tag/v2.12.0).
2. If unable to upgrade immediately, set 'allowOwnAccountEdit = false' in the Pocket ID configuration to block users from modifying their email address via PUT /api/users/me.
3. Review Pocket ID user records to verify that no low-privileged user accounts have claimed and verified administrative or unowned corporate email addresses.
4. Audit downstream OIDC client applications (e.g., GitLab, Grafana, Nextcloud) for unauthorized account linking events and disable email-based auto-linking where possible.

References

• GitHub Security Advisory GHSA-rm8c-2cv8-jwf6
• Official Fix Pull Request #1625
• Official Patch Commit 43aaccd5bfacb76283b11ce039fb3f0716196fcb
• Pocket ID Release v2.12.0
• CVE Record (CVE.org): CVE-2026-115770
• NVD Vulnerability Detail: CVE-2026-115770
• CVE List v5 Raw Record: CVE-2026-115770

Read the full report for CVE-2026-115770 on our website for more details including interactive diagrams and full exploit analysis.