# Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVE-2026-115770)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-rm8c-2cv8-jwf6) · 2026-11-09 · Security
Page: https://themorning.dev/story/pocket-id-email-verification-token-remains-valid-after-address-change-enabling-a-2a6eb1b7648bdfa1
Kind: security · Impact: medium

## In brief

- An authenticated Pocket ID user can request an email-verification token while the account uses an address they control.
- The user can then change the account email address and still redeem the previously issued token.
- The flaw enables arbitrary verified-email spoofing and is tracked as CVE-2026-115770.

## Why it matters

Email verification no longer reliably proves who controls an address on affected Pocket ID instances, so verified-email claims can be spoofed by any authenticated user.

## CVEs

- CVE-2026-115770

## Timeline

- 2026-11-09: Advisory published in GitHub Advisory Database

## Coverage

- [Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVE-2026-115770)](https://github.com/advisories/GHSA-rm8c-2cv8-jwf6) — GitHub Advisory Database, 2026-11-09

Tags: authentication, security, pocket-id, email-verification, cve-2026-115770

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev