Pocket ID: Arbitrary verified email spoofing (CVE-2026-115770)

Pocket ID (CVE-2026-115770) contains an authentication integrity flaw where email verification tokens are bound only to the user ID rather than the email address being verified. This allows an authenticated user to initiate an email verification process for an address they control, subsequently update their account to a victim's address, and finally redeem the original, still-valid verification token to mark the victim's address as verified.

Attack Chain

1. Attacker authenticates to their own Pocket ID account using an attacker-controlled email address.
2. Attacker invokes the API to request an email verification token.
3. Attacker receives the verification token at the controlled email address.
4. Attacker updates their account profile via API, replacing their email address with the victim's target address.
5. Pocket ID updates the account email to the victim's address but retains the previously issued verification token.
6. Attacker redeems the original verification token against the account, causing Pocket ID to mark the victim's address as verified.
7. Attacker completes an OIDC flow with the relying party, which consumes the false 'email_verified: true' claim to link the attacker's identity to the victim's existing account.

Impact

Successful exploitation results in arbitrary verified email spoofing within the Pocket ID OIDC provider. Relying applications that utilize the email and email_verified claims for account linking or auto-provisioning are vulnerable to cross-application account takeover, potentially exposing victim data and permissions.

Recommendation

1. Immediately upgrade Pocket ID backend to version 0.0.0-20260727180059-43aaccd5bfac or later.
2. Invalidate all existing unredeemed email verification tokens upon any modification of the account email address.
3. Audit OIDC relying party configurations to ensure that account linking logic does not trust email_verified claims without additional multi-factor authentication or secondary identity verification.
4. Ensure all future verification tokens are cryptographically bound to the specific target email address, ensuring token redemption fails if the email address has changed.