CVE-2026-115770 - Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
CVE ID :CVE-2026-115770 Published : Nov. 4, 2026, 11:17 p.m. | 1 hour, 49 minutes ago Description :Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in...