Is CVE-2026-115770 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115770 being exploited in the wild.

How severe is CVE-2026-115770?

Critical severity, with a CVSS score of 9.6, published 4 November 2026.

Which products and versions are affected?

github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260727180059-43aaccd5bfac, SEMVER:introduced=0,fixed=0.0.0-20260727180059-43aaccd5bfac; Pocket-Id Pocket Id 2.2.0 through 2.12.0.

Is there a fix for CVE-2026-115770?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260727180059-43aaccd5bfac or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115770 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115770?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115770: Pocket ID email verification token privilege escalation

Q: Is there a fix for CVE-2026-115770?

Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260727180059-43aaccd5bfac or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115770 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-115770?

Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115770 · Severity: critical · CVSS 9.6 · Published 2026-11-04

Pocket ID is an authentication system that uses passkeys to allow users to log into services. A vulnerability in versions 2.2.0 through 2.12.0 allows an attacker to change another user's email address to one they control and mark it as verified, potentially taking over that user's account at connected services. This affects deployments where automatic account matching relies on verified email addresses.

Technologies: github.com/pocket-id/pocket-id/backend (Go), Pocket-Id Pocket Id. Vendors: Go, Pocket-Id.

Quick answers

Is CVE-2026-115770 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115770 being exploited in the wild.
How severe is CVE-2026-115770?: Critical severity, with a CVSS score of 9.6, published 4 November 2026.
Which products and versions are affected?: github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260727180059-43aaccd5bfac, SEMVER:introduced=0,fixed=0.0.0-20260727180059-43aaccd5bfac; Pocket-Id Pocket Id 2.2.0 through 2.12.0.
Is there a fix for CVE-2026-115770?: Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260727180059-43aaccd5bfac or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115770 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115770?: Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260727180059-43aaccd5bfac or later
```
go get github.com/pocket-id/pocket-id/backend@v0.0.0-20260727180059-43aaccd5bfac
```

Technical details

The SendEmailVerification token in Pocket ID binds only to a user identifier and does not invalidate when UpdateUser changes the account email. An attacker can request a verification token for an email they control, change the target account's email to an unregistered address, and redeem the original token to mark the new email as verified. Applications relying on the stable OIDC sub claim are unaffected, but those trusting verified email for account matching can be exploited for account linkage.

Affected products

Pocket ID Pocket ID 2.2.0 through 2.12.0

Identifiers

CVE-2026-115770
GHSA-rm8c-2cv8-jwf6

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.