Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

Fix availableCritical · CVSS 9.6EPSS 0.17%

Published Nov 9, 2026 · updated Nov 9, 2026

What to do

  1. Upgrade to a fixed version: github.com/pocket-id/pocket-id/backend 0.0.0-20260727180059-43aaccd5bfac.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/pocket-id/pocket-id/backend

Vulnerable versions
< 0.0.0-20260727180059-43aaccd5bfac
Fixed in
0.0.0-20260727180059-43aaccd5bfac

Check your project: go list -m all | grep github.com/pocket-id/pocket-id/backend

What changed

  1. Nov 9, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-345 Insufficient Verification of Data Authenticity

← All critical vulnerabilities