AIKIDO-2026-10566

github.com/pocketbase/pocketbase is vulnerable to OAuth2 account pre-hijacking via autolinking

OAuth2 account pre-hijacking via autolinkingGHSA-pq7p-mc74-g65w Published Apr 27, 2026

Medium Risk

This Affects:

github.com/pocketbase/pocketbase

0.0.1 - 0.22.41

Fixed in 0.22.42

0.23.0 - 0.37.3

Fixed in 0.37.4

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to OAuth2 account pre-hijacking. An attacker who knows the victim's email can pre-create an unverified PocketBase auth record by signing in with one OAuth2 provider (e.g. provider A). When the victim later signs up using a different OAuth2 provider (e.g. provider B), PocketBase autolinks the existing unverified record and upgrades it to verified, but it does not clear the attacker's previously-linked external OAuth2 entry. The attacker therefore retains OAuth2 login access to the now-verified account. The fix deletes pre-existing external OAuth2 links on the unverified-to-verified upgrade and clears conflicting links during OAuth2 login for unverified records.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and have OAuth2 authentication enabled with at least two providers configured. Exploitation requires the attacker to know the victim's email and the victim to subsequently sign up via a different OAuth2 provider than the one the attacker pre-linked.