Product
Pocket ID fails to cryptographically bind email verification tokens to target addresses, allowing authenticated users to spoof verified email claims for account takeover on relying applications.