CVE-2026-44166

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44166", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T14:39:34.923Z", "datePublished": "2026-05-12T17:16:59.613Z", "dateUpdated": "2026-05-12T18:50:17.712Z"}, "containers": {"cna": {"title": "Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w"}], "affected": [{"vendor": "pocketbase", "product": "pocketbase", "versions": [{"version": "< 0.22.42", "status": "affected"}, {"version": ">= 0.30.0, < 0.37.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T17:16:59.613Z"}, "descriptions": [{"lang": "en", "value": "Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OAuth2 app providers, e.g. \"A\". When the victim gets invited or decides to sign up to your app on their own with provider \"B\" (PocketBase OAuth2 auth requires to be with a different provider because we don't allow multiple OAuth2 accounts from the same provider to be associated to a single PocketBase user), the user created previously by the attacker will be autolinked, upgraded to \"verified\" and its old password reset. This vulnerability is fixed in 0.22.42 and 0.37.4."}], "source": {"advisory": "GHSA-pq7p-mc74-g65w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T18:46:42.906618Z", "id": "CVE-2026-44166", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:50:17.712Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T18:46:42.906618Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:47:15.773Z"}}], "cna": {"title": "Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade", "source": {"advisory": "GHSA-pq7p-mc74-g65w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "pocketbase", "product": "pocketbase", "versions": [{"status": "affected", "version": "< 0.22.42"}, {"status": "affected", "version": ">= 0.30.0, < 0.37.4"}]}], "references": [{"url": "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w", "name": "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OAuth2 app providers, e.g. \"A\". When the victim gets invited or decides to sign up to your app on their own with provider \"B\" (PocketBase OAuth2 auth requires to be with a different provider because we don't allow multiple OAuth2 accounts from the same provider to be associated to a single PocketBase user), the user created previously by the attacker will be autolinked, upgraded to \"verified\" and its old password reset. This vulnerability is fixed in 0.22.42 and 0.37.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T17:16:59.613Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44166", "state": "PUBLISHED", "dateUpdated": "2026-05-12T18:50:17.712Z", "dateReserved": "2026-05-05T14:39:34.923Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T17:16:59.613Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pocketbase", "vendor": "pocketbase", "versions": [{"status": "affected", "version": "< 0.22.42"}, {"status": "affected", "version": ">= 0.30.0, < 0.37.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pocketbase:pocketbase:*:*:*:*:*:go:*:*", "matchCriteriaId": "82C3D53E-1FEE-4477-985C-9392048F2F33", "versionEndExcluding": "0.22.42", "vulnerable": true}, {"criteria": "cpe:2.3:a:pocketbase:pocketbase:*:*:*:*:*:go:*:*", "matchCriteriaId": "4D5B2E3F-7B3E-4F34-ACFF-42FCC50A2363", "versionEndExcluding": "0.37.4", "versionStartIncluding": "0.23.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OAuth2 app providers, e.g. \"A\". When the victim gets invited or decides to sign up to your app on their own with provider \"B\" (PocketBase OAuth2 auth requires to be with a different provider because we don't allow multiple OAuth2 accounts from the same provider to be associated to a single PocketBase user), the user created previously by the attacker will be autolinked, upgraded to \"verified\" and its old password reset. This vulnerability is fixed in 0.22.42 and 0.37.4."}, {"lang": "es", "value": "Pocketbase es un backend web de c\u00f3digo abierto escrito en go. Anteriormente a las versiones 0.22.42 y 0.37.4, en algunas situaciones, si un atacante conoce la direcci\u00f3n de correo electr\u00f3nico de la v\u00edctima, puede crear y vincular un usuario de PocketBase no verificado con antelaci\u00f3n autentic\u00e1ndose con uno de los proveedores de aplicaciones OAuth2, por ejemplo, \u2019A\u2019. Cuando la v\u00edctima es invitada o decide registrarse en su aplicaci\u00f3n por su cuenta con el proveedor \u2019B\u2019 (la autenticaci\u00f3n OAuth2 de PocketBase requiere que sea con un proveedor diferente porque no permitimos que m\u00faltiples cuentas OAuth2 del mismo proveedor se asocien a un \u00fanico usuario de PocketBase), el usuario creado previamente por el atacante se vincular\u00e1 autom\u00e1ticamente, se actualizar\u00e1 a \u2019verificado\u2019 y su antigua contrase\u00f1a se restablecer\u00e1. Esta vulnerabilidad est\u00e1 corregida en las versiones 0.22.42 y 0.37.4."}], "id": "CVE-2026-44166", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44166", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T18:46:42.906618Z", "version": "2.0.3"}}]}, "published": "2026-05-12T18:17:29.123", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.22.42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.30.0,0.37.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pocketbase", "source": "cna", "vendor": "pocketbase"}, "product": "pocketbase", "vendor": "pocketbase"}], "created": "2026-05-12T20:45:23.807717+00:00", "updated": "2026-05-13T10:37:58.748821+00:00", "vendors": ["pocketbase", "pocketbase$PRODUCT$pocketbase"]}