Email Verification Vulnerability in Pocket ID by Pocket ID

CVE-2026-115770

What is CVE-2026-115770?

The email verification process in Pocket ID (versions 2.2.0 to 2.12.0) contains a vulnerability that allows an ordinary user to misuse the email verification token system. This flaw permits users to change their account email address without invalidating the associated verification token. A malicious user could obtain a verification token for one email address, then change the account to a different address they control, thus compromising account security. This can mislead relying applications into associating the attacker's identity with another user's account. The issue was addressed in version 2.12.0, ensuring a more robust handling of email-verification tokens.

References