{"id":"EM-20261109-700C","url":"https://cyber.eventmonitor.net/incident/EM-20261109-700C/critical-pocket-id-vulnerability-cve-2026-115770/","type":"cve","title":"Critical Pocket ID Vulnerability (CVE-2026-115770)","subtitle":"CVE-2026-115770","subject":"CVE-2026-115770","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-09T22:12:21.000Z","firstSignal":"2026-11-04T23:17:18.767Z","lastSignal":"2026-11-09T22:12:21.000Z","updated":"2026-11-09T23:10:58.551Z","revision":1,"life":[{"status":"Born","at":"2026-11-09T22:12:21.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-09T22:12:21.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T23:17:18.767Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-09T22:12:21.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261109-700C created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T23:17:18.767Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T23:17:18.767Z","detail":"CVSS 9.6 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T23:17:18.767Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-115770 (CVSS 9.6)","text":"Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115770"},{"at":"2026-11-09T22:12:21.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":4,"title":"GHSA-rm8c-2cv8-jwf6 / CVE-2026-115770: Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing","text":"go:github.com/pocket-id/pocket-id/backend","url":"https://github.com/advisories/GHSA-rm8c-2cv8-jwf6"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T23:17:18.767","score":9.6,"severity":"CRITICAL","desc":"Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identifier, while…","product":"","seen":1793844384577},"kev":null,"epss":{"epss":0.00166,"pct":0.05941,"at":1794265858551},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}