Skip to content
OpenAdvisories

Package · Go

github.com/pocketbase/pocketbase

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2026-44166 Public exploit

    Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

    Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the O…

    pocketbase pocketbase github.com/pocketbase/pocketbase Go