# CVE-2026-115770: Pocket ID email verification token privilege escalation

Source: https://junglewise.ai/threats/cve-2026-115770-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-115770 · Severity: critical · CVSS 9.6 · Published 2026-11-04

Pocket ID is an authentication system that uses passkeys to allow users to log into services. A vulnerability in versions 2.2.0 through 2.12.0 allows an attacker to change another user's email address to one they control and mark it as verified, potentially taking over that user's account at connected services. This affects deployments where automatic account matching relies on verified email addresses.

Technologies: [github.com/pocket-id/pocket-id/backend (Go)](https://junglewise.ai/threats/technologies/github-com-pocket-id-pocket-id-backend), [Pocket-Id Pocket Id](https://junglewise.ai/threats/technologies/pocket-id). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Pocket-Id](https://junglewise.ai/threats/vendors/pocket-id).

## Quick answers

**Is CVE-2026-115770 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115770 being exploited in the wild.

**How severe is CVE-2026-115770?** Critical severity, with a CVSS score of 9.6, published 4 November 2026.

**Which products and versions are affected?** github.com/pocket-id/pocket-id/backend (Go) < 0.0.0-20260727180059-43aaccd5bfac, SEMVER:introduced=0,fixed=0.0.0-20260727180059-43aaccd5bfac; Pocket-Id Pocket Id 2.2.0 through 2.12.0.

**Is there a fix for CVE-2026-115770?** Yes. github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260727180059-43aaccd5bfac or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115770 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115770?** Check whether you run github.com/pocket-id/pocket-id/backend (Go) or Pocket-Id Pocket Id at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/pocket-id/pocket-id/backend (Go): upgrade to 0.0.0-20260727180059-43aaccd5bfac or later

  ```sh
  go get github.com/pocket-id/pocket-id/backend@v0.0.0-20260727180059-43aaccd5bfac
  ```


## Technical details

The SendEmailVerification token in Pocket ID binds only to a user identifier and does not invalidate when UpdateUser changes the account email. An attacker can request a verification token for an email they control, change the target account's email to an unregistered address, and redeem the original token to mark the new email as verified. Applications relying on the stable OIDC sub claim are unaffected, but those trusting verified email for account matching can be exploited for account linkage.

## Affected products

- Pocket ID Pocket ID 2.2.0 through 2.12.0

## Identifiers

- CVE-2026-115770
- GHSA-rm8c-2cv8-jwf6

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/pocket-id/pocket-id/commit/43aaccd5bfacb76283b11ce039fb3f0716196fcb](https://github.com/pocket-id/pocket-id/commit/43aaccd5bfacb76283b11ce039fb3f0716196fcb)
- [https://github.com/pocket-id/pocket-id/pull/1625](https://github.com/pocket-id/pocket-id/pull/1625)

## Related threats

- [Pocket ID OIDC audience validation bypass](https://junglewise.ai/threats/cve-2026-62662-pocket-id-is-an-oidc-provider-that-allows-users-to-authenticate)
- [Pocket-ID open redirect in OIDC authorize page with prompt=none](https://junglewise.ai/threats/cve-2026-55834-pocket-id-open-redirect-in-oidc-authorize-page-with-prompt-none)
- [GO-2026-6117 - Pocket ID has a reauthentication bypass via one-time access token login , passkey step-up requirement…](https://junglewise.ai/threats/go-2026-6117-pocket-id-has-a-reauthentication-bypass-via-one-time-97f49b16)
- [Pocket ID reauthentication bypass via JWT freshness check fallback](https://junglewise.ai/threats/pocket-id-reauthentication-bypass-via-jwt-freshness-check-fallback-515ed392)
- [Pocket ID improper authorization in OIDC refresh token flow](https://junglewise.ai/threats/cve-2026-43983-pocket-id-improper-authorization-in-oidc-refresh-token-flow)