Executive brief
PocketBase is an open-source backend used to power web and mobile applications. A security flaw in its login system allows an attacker to 'pre-hijack' a user's account if they know the victim's email address. By linking their own social login (OAuth2) to a victim's email before the victim signs up, the attacker maintains access to the account even after the real user joins and verifies the account, potentially leading to unauthorized data access and account takeover.
Technical details
An authentication bypass vulnerability exists in PocketBase's OAuth2 autolinking logic. When an attacker creates an unverified user account using one OAuth2 provider (e.g., Provider A) with a victim's email address, and the victim later authenticates using a different OAuth2 provider (e.g., Provider B), PocketBase autolinks the accounts and upgrades the user to 'verified' status. However, the application fails to clear the attacker's original OAuth2 link during this transition. This allows the attacker to maintain persistent access to the now-verified victim account. The vulnerability is fixed in versions 0.22.42 and 0.37.4 by ensuring all pre-existing OAuth2 links are deleted during unverified-to-verified upgrades.
Affected products
- PocketBase PocketBase < 0.22.42, < 0.37.4
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD