pocket-id vulnerabilities
CVEs whose affected-version data names the pocket-id package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115770Critical· 9.6Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-v…
▾ Midnightpocket-id · pocket-idvia CVEORG
CVE-2026-62662High· 7.7Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resourc…
▾ Twilightpocket-id · pocket-idvia CVEORG