Threats affecting pkg:github/pocket-id/pocket-id

CVE-2026-115770 is a critical vulnerability in pocket-id versions 2.2.0 through 2.11.x where insufficient verification of email verification tokens allows an attacker to change an account's email address and mark it as verified without invalidating the original token. This can lead to an attacker linking their identity to another user's account if the relying application trusts verified emails for account matching. The issue is fixed in version 2.12.0.

CVE-2026-62662 is a high-severity vulnerability in Pocket ID versions from 1.11.0 up to but not including 2.10.0. The flaw involves improper input validation in the createTokenFromClientCredentials function, which allows any authenticated OIDC client to obtain access tokens with arbitrary or unauthorized audiences. This bypasses audience-based access controls in deployments that rely on these tokens for service-to-service authorization, potentially permitting unauthorized data access or actions. The issue is fixed in version 2.10.0.