Threats tagged 'ghsa-rm8c-2cv8-jwf6'

An authenticated Pocket ID user can exploit a flaw where an email verification token remains valid after changing the account email address. The token is bound only to the user ID, not the email address, allowing the attacker to verify an email address they do not control. This leads to the system marking the new email as verified without proof of control. Consequently, relying parties that trust the verified email claim in OIDC can be tricked into linking the attacker's identity to a victim's account, enabling cross-application account takeover.