Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in Pocket ID, an OpenID Connect provider used for passkey authentication, could allow an attacker to associate a new email address with an existing user's account. This occurs when a user's email verification token is not properly invalidated after an account's email address is changed, potentially leading to account takeovers or unauthorized access for applications that rely on verified email addresses for account provisioning or matching. Applications exclusively using the stable OIDC subject claim are not impacted.
- Email verification tokens can be misused.
- Affects applications trusting verified emails.
- Confirm relevance and check for exposure.
Attack Path
How an attacker could exploit the issue
An attacker with an existing account can exploit this vulnerability by first requesting an email verification token for an email address they control. Then, they can change their account's email to an arbitrary, unused address and subsequently redeem the old verification token. This process tricks Pocket ID into publishing the attacker's newly associated email address as verified. This can lead to a relying application mistakenly linking the attacker's identity to another user's account if it uses verified emails for automatic account matching.
- Requires attacker account and email control.
- Redeem old token after changing account email.
- Links attacker to another user's account.
Live Threat
Current exploitation, exposure, and threat context
When configured with `allowOwnAccountEdit=true`, an ordinary user could exploit a flaw in email verification and account updating to associate a verified email address with an arbitrary account. This could lead to a relying application incorrectly linking an attacker's identity to another user's account, particularly in systems that automatically match or provision accounts based on verified emails. Applications that solely rely on the stable OIDC sub claim are not impacted by this downstream consequence.
- User account email verification data.
- An attacker could change account email.
- Incorrect account linking by applications.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Pocket ID OIDC provider is susceptible to an issue where an attacker can take over another user's account. Platform or infrastructure teams responsible for deploying and managing Pocket ID instances should identify all deployments, assess their reachability and criticality, and confirm ownership. This will enable a risk-based remediation plan, which may involve coordinating with vendors or applying temporary controls.
- Identify affected Pocket ID instances.
- Confirm reachability and criticality.
- Plan remediation based on risk.
