Vulnerability · critical · CVSS 9.6
Pocket ID email verification token remains valid after address change (CVE-2026-115770)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Pocket ID deployments; any authenticated user can spoof verified emails
Tier B because: Exploited in the wild OR public exploit
Reach
Attack
Damage
Fix
Public exploit · Full takeover
The Brief
- An authenticated Pocket ID user can request an email-verification token while the account uses an address they control.
- The user can then change the account email address and still redeem the previously issued token.
- The flaw enables arbitrary verified-email spoofing and is tracked as CVE-2026-115770.
Why it matters
Email verification no longer reliably proves who controls an address on affected Pocket ID instances, so verified-email claims can be spoofed by any authenticated user.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Pocket ID is a self-hosted identity provider that ops and IT teams deploy and run. |
| No | Core infrastructure | Judgment: a single self-hosted identity product, not software nearly every team runs. |
| No | Popular tool | Judgment: Pocket ID is a niche open-source project, not a widely used mainstream tool. |
| No | Exploited in the wild | GitHub Advisory Database: describes the flaw only; no observed attacks reported. |
| Yes | Public exploit | CISA SSVCCISA rates exploitation of CVE-2026-115770 as proof of concept public |
| No | Remote, no login | CVSSCVSS: CVE-2026-115770 AV:N/PR:L/UI:N |
| Yes | Full takeover | CVSSCVE-2026-115770: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | GitHub Advisory Database: describes a token validity flaw; no stolen or exposed data reported. |
| No | Supply chain | GitHub Advisory Database: a normal authorization bug in legitimate code; no malicious code shipped. |
| No | No fix yet | GitHub AdvisoryGitHub Advisory: github.com/pocket-id/pocket-id/backend fixed in 0.0.0-20260727180059-43aaccd5bfac |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-115770 ↗CVSS 9.6 critical AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
- Exploited
- Proof of concept public (CISA)
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 5.9% of all CVEs
- Fix
- github.com/pocket-id/pocket-id/backend (go) fixed in 0.0.0-20260727180059-43aaccd5bfac
- Weakness
- CWE-345
Timeline
Advisory published in GitHub Advisory Database
GitHub Advisory Database
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVE-2026-115770)
Source
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVE-2026-115770) ↗ GitHub Advisory Database · 2h ago
First seen · 1 source · Full story page · How tiers are decided