Pocket ID email verification token survives address change, allowing verified-email spoofing
Attackers can take over other people's accounts on a Pocket ID login server!
Summary
In Pocket ID, an email verification token stays valid after the account email is changed, so an ordinary user can switch the account to another unused address and have it published as verified. Versions from 2.2.0 before 2.12.0 are affected.
Affected when
- emailsVerified=false and allowOwnAccountEdit=true (default settings)
- The target address does not belong to another Pocket ID user
What to do
Update to 2.12.0 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen