CVE-2026-44166 Details
Description
Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OAuth2 app providers, e.g. "A". When the victim gets invited or decides to sign up to your app on their own with provider "B" (PocketBase OAuth2 auth requires to be with a different provider because we don't allow multiple OAuth2 accounts from the same provider to be associated to a single PocketBase user), the user created previously by the attacker will be autolinked, upgraded to "verified" and its old password reset. This vulnerability is fixed in 0.22.42 and 0.37.4.
A pre-hijacking vulnerability has been identified in Pocketbase versions prior to 0.22.42 and 0.37.4. This issue allows an attacker who knows the victim's email address to create and link an unverified Pocketbase user by authenticating with an OAuth2 provider. When the victim later signs up with a different provider, the attacker-linked account is automatically upgraded to verified status, and the password is reset, potentially allowing the attacker to gain access. This vulnerability arises because the previous OAuth2 links are not cleared, leaving the attacker with access to the account.
Users are advised to upgrade to Pocketbase version 0.37.4 or 0.22.42 if using an older release prior to 0.23.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pocketbase pocketbase | < 0.22.42 >= 0.23.0, < 0.37.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | [email protected] |