SecurityFan score 43 · Tier B
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVE-2026-115770)
The Brief
- An authenticated Pocket ID user can request an email-verification token while the account uses an address they control.
- The user can then change the account email address and still redeem the previously issued token.
- The flaw enables arbitrary verified-email spoofing and is tracked as CVE-2026-115770.
Why it matters
Email verification no longer reliably proves who controls an address on affected Pocket ID instances, so verified-email claims can be spoofed by any authenticated user.
Who’s affected
- Operators of Pocket ID instances running the affected backend
- CVE-2026-115770
- #authentication
- #security
- #pocket-id
- #email-verification
- #cve-2026-115770
Affects github.com/pocket-id/pocket-id/backend. Summary An authenticated Pocket ID user can request an email-verification token while their account uses an address they control, change the account email address, and then redeem the previously issued token. The token is bound…
Timeline
Advisory published in GitHub Advisory Database
GitHub Advisory Database
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVE-2026-115770)