Skip to content
OpenAdvisories

Package · Go

github.com/pocket-id/pocket-id/backend

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2026-115770

    Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

    Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only…

    pocket-id pocket-id github.com/pocket-id/pocket-id/backend Go