{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-115770/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pocket-id:pocket-id:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-115770"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pocket-id (\u003c 0.0.0-20260727180059-43aaccd5bfac)"],"_cs_severities":["medium"],"_cs_tags":["authentication-bypass","identity-provider","oidc","cve-2026-115770"],"_cs_type":"advisory","_cs_vendors":["Pocket ID"],"content_html":"\u003cp\u003ePocket ID (CVE-2026-115770) contains an authentication integrity flaw where email verification tokens are bound only to the user ID rather than the email address being verified. This allows an authenticated user to initiate an email verification process for an address they control, subsequently update their account to a victim's address, and finally redeem the original, still-valid verification token to mark the victim's address as verified.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to their own Pocket ID account using an attacker-controlled email address.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the API to request an email verification token.\u003c/li\u003e\n\u003cli\u003eAttacker receives the verification token at the controlled email address.\u003c/li\u003e\n\u003cli\u003eAttacker updates their account profile via API, replacing their email address with the victim's target address.\u003c/li\u003e\n\u003cli\u003ePocket ID updates the account email to the victim's address but retains the previously issued verification token.\u003c/li\u003e\n\u003cli\u003eAttacker redeems the original verification token against the account, causing Pocket ID to mark the victim's address as verified.\u003c/li\u003e\n\u003cli\u003eAttacker completes an OIDC flow with the relying party, which consumes the false 'email_verified: true' claim to link the attacker's identity to the victim's existing account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary verified email spoofing within the Pocket ID OIDC provider. Relying applications that utilize the \u003ccode\u003eemail\u003c/code\u003e and \u003ccode\u003eemail_verified\u003c/code\u003e claims for account linking or auto-provisioning are vulnerable to cross-application account takeover, potentially exposing victim data and permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately upgrade Pocket ID backend to version 0.0.0-20260727180059-43aaccd5bfac or later.\u003c/li\u003e\n\u003cli\u003eInvalidate all existing unredeemed email verification tokens upon any modification of the account email address.\u003c/li\u003e\n\u003cli\u003eAudit OIDC relying party configurations to ensure that account linking logic does not trust \u003ccode\u003eemail_verified\u003c/code\u003e claims without additional multi-factor authentication or secondary identity verification.\u003c/li\u003e\n\u003cli\u003eEnsure all future verification tokens are cryptographically bound to the specific target email address, ensuring token redemption fails if the email address has changed.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-11T16:05:27Z","date_published":"2026-11-11T16:05:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pocket-id-email-spoofing-ghsa-rm8c-2cv8-jwf6/","summary":"Pocket ID fails to cryptographically bind email verification tokens to target addresses, allowing authenticated users to spoof verified email claims for account takeover on relying applications.","title":"Pocket ID: Arbitrary verified email spoofing (CVE-2026-115770)","url":"https://feed.craftedsignal.io/briefs/2026-11-pocket-id-email-spoofing-ghsa-rm8c-2cv8-jwf6/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-115770","version":"https://jsonfeed.org/version/1.1"}