CVE-2026-115770

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/emailverificationtoken.go to bind an email-verification token only to the user's identifier, while...

CVE-2026-115770 Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/emailverificationtoken.go to bind an email-verification token only to the user's identifier, while...

CVE-2026-115770

The OIDC provider Pocket ID versions 2.2.0 through 2.12.0 are vulnerable to an email verification bypass. The root cause lies in backend/internal/model/email_verification_token.go, where a verification token is bound to a user's identifier but is not invalidated when the account email is updated ...

PT-2026-137227

Name of the Vulnerable Software and Affected Versions Pocket ID versions 2.2.0 through 2.11.0 Description An issue exists where the SendEmailVerification function uses a token model that binds an email-verification token only to the user identifier. Because the UpdateUser function allows changing...

UBB.Threads 6 Remote File Inclusion

..:::::::::.. ..:::aad8888888baa:::.. .::::d:?88888888888?::8b::::. .:::d8888:?88888888??a888888b:::. .:::d8888888a8888888aa8888888888b:::. ::::dP::::::::Dz-GhostTeam:::::::Yb:::: ::::dP:::::::::Y888888888P:::::::::Yb:::: ::::d8:::::::::::indoushka:::::::::::8b::::...