CVE-2026-115770

Summary

In Pocket ID versions 2.2.0–2.12.0, a user can request an email verification token for an address they control, change their account email to an arbitrary unused address, and redeem the original token to falsely mark the new address as verified, bypassing proper email ownership validation.

Exploitability

Exploitation requires only valid user credentials (low-privileged access) and control over a target email address; no special tools or complex conditions are needed.

Blast radius

Relying applications that use verified email for account linking or provisioning may incorrectly associate the attacker’s identity with another user’s account, potentially enabling account takeover or unauthorized access.

Detection

Log entries showing a VerifyEmail call with an email_verification_token that was issued for a different email address than the one currently bound to the user account may indicate exploitation; compare token creation timestamp/email with subsequent UpdateUser calls and VerifyEmail attempts.

Prioritized remediation

Upgrade to Pocket ID version 2.12.0 or later, which fixes the token binding to prevent reuse after email changes.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.