Attack Chain

1. Attacker authenticates to their own Pocket ID account using an attacker-controlled email address.
2. Attacker invokes the API to request an email verification token.
3. Attacker receives the verification token at the controlled email address.
4. Attacker updates their account profile via API, replacing their email address with the victim's target address.
5. Pocket ID updates the account email to the victim's address but retains the previously issued verification token.
6. Attacker redeems the original verification token against the account, causing Pocket ID to mark the victim's address as verified.
7. Attacker completes an OIDC flow with the relying party, which consumes the false 'email_verified: true' claim to link the attacker's identity to the victim's existing account.

Impact

Successful exploitation results in arbitrary verified email spoofing within the Pocket ID OIDC provider. Relying applications that utilize the email and email_verified claims for account linking or auto-provisioning are vulnerable to cross-application account takeover, potentially exposing victim data and permissions.

Recommendation

1. Immediately upgrade Pocket ID backend to version 0.0.0-20260727180059-43aaccd5bfac or later.
2. Invalidate all existing unredeemed email verification tokens upon any modification of the account email address.
3. Audit OIDC relying party configurations to ensure that account linking logic does not trust email_verified claims without additional multi-factor authentication or secondary identity verification.
4. Ensure all future verification tokens are cryptographically bound to the specific target email address, ensuring token redemption fails if the email address has changed.