Advisories · Technology
pocket-id.
Every CVE that names pocket-id among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
- pocket-id
- CWE-345
- CVSS 7.7 High
Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
- pocket-id
- Broken access control
- CWE-20