WhatBrokeToday
FAQ
Today's Trends
criticalInvestigatingv< 0.0.0-20260727180059-43aaccd5bfac

Pocket ID Backend: Email Verification Token Remains Valid After Address Change

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

An authenticated user in Pocket ID can request an email-verification token, change their account email address, and redeem the previously issued token. Because the token is bound only to the user ID rather than the email address, this vulnerability allows arbitrary verified-email spoofing.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

The email-verification token is bound only to the user ID and not to the specific email address to which it was originally issued.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    github.com/pocket-id/pocket-id/backend: Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing(opens security advisory in a new tab)

    Fixed in: github.com/pocket-id/pocket-id/backend 0.0.0-20260727180059-43aaccd5bfac. Critical severity (CVE-2026-115770). Affected: github.com/pocket-id/pocket-id/backend (go) < 0.0.0-20260727180059-43aaccd5bfac. ## Summary An authenticated Pocket ID user can request an email-verification token while their account uses an address they control, change the account email address, and then redeem the previously issued token. The token is bound only to the user ID, not to the address to which it was…

    by GitHub Advisory Database 0upvotes 0comments

Timeline

  1. First report on security advisory

    github.com/pocket-id/pocket-id/backend: Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

    Source