CVE-2026-44166: Pocketbase Auth Bypass Vulnerability

CVE-2026-44166 Overview

CVE-2026-44166 is an authentication flaw in PocketBase, an open source Go-based web backend. The vulnerability allows an attacker who knows a victim's email address to pre-register an unverified account using one OAuth2 provider. When the victim later signs up with a different OAuth2 provider, PocketBase auto-links the existing attacker-controlled account, marks it verified, and resets its password. This results in account takeover before the victim has even registered. Versions prior to 0.22.42 and 0.37.4 are affected. The issue is tracked under [CWE-287] Improper Authentication.

Critical Impact
An attacker with knowledge of a target's email can pre-hijack a PocketBase account and gain access once the victim onboards through a separate OAuth2 provider.

Affected Products

PocketBase versions prior to 0.22.42
PocketBase versions prior to 0.37.4
Applications using PocketBase OAuth2 authentication with multiple providers

Discovery Timeline

2026-05-12 - CVE-2026-44166 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44166

Vulnerability Analysis

The flaw resides in PocketBase's OAuth2 account-linking logic. PocketBase enforces that a single user cannot link two OAuth2 accounts from the same provider. To accommodate multi-provider sign-in, it auto-links accounts that share an email address across different providers. The auto-link routine does not verify whether the existing account is in a trusted state before promoting it to verified and rotating credentials. An attacker exploits this by creating an unverified account tied to the victim's email through provider A. When the victim signs up with provider B, the pre-existing record is reused. The victim's new authentication is bound to the attacker's pre-staged account, granting the attacker persistent access through provider A.

Root Cause

The root cause is unsafe trust placed in OAuth2 email claims when reconciling accounts. PocketBase treats matching email addresses as sufficient identity proof for cross-provider linking. It does not require the pre-existing account to have completed email verification before auto-linking. The verification status is then mutated to verified during the link, eliminating the safeguard.

Attack Vector

The attack is network-based and requires user interaction from the victim. The attacker first registers an unverified PocketBase user via OAuth2 provider A using the victim's email. The attacker controls the password on this account. When the victim later signs up or accepts an invitation using provider B, PocketBase merges the records. The victim's old password is reset and the account is upgraded to verified. The attacker retains login access through provider A and can use account recovery flows to take full control. See the PocketBase Security Advisory GHSA-pq7p-mc74-g65w for technical details.

Detection Methods for CVE-2026-44166

Indicators of Compromise

Existence of unverified PocketBase user records created via OAuth2 that were later auto-linked to a second provider.
Audit log entries showing rapid transitions of a user from unverified to verified following a second-provider OAuth2 sign-in.
Password reset events on auto-linked accounts occurring at the moment of cross-provider linking.

Detection Strategies

Query the PocketBase user collection for accounts with multiple externalAuths entries where the earliest record predates the user's verification timestamp.
Review OAuth2 sign-in telemetry for accounts created with one provider but never confirmed before being linked to another.
Correlate user creation timestamps with first interactive login to identify pre-staged accounts.

Monitoring Recommendations

Enable verbose authentication logging on PocketBase and forward events to a centralized SIEM for retention and correlation.
Alert on any auto-link event that promotes an unverified account to verified status.
Monitor for OAuth2 registrations using high-value email domains that do not complete verification within a short window.

How to Mitigate CVE-2026-44166

Immediate Actions Required

Upgrade PocketBase to version 0.22.42 or 0.37.4 immediately, depending on the release branch in use.
Audit existing user records for unverified accounts that were later auto-linked across OAuth2 providers and force password resets where appropriate.
Notify users of any accounts flagged during the audit and require re-verification through a trusted channel.

Patch Information

The vulnerability is fixed in PocketBase 0.22.42 and 0.37.4. The fixed releases tighten the OAuth2 auto-linking logic so that pre-existing unverified accounts cannot be silently merged and elevated. Refer to the PocketBase Security Advisory GHSA-pq7p-mc74-g65w for upgrade guidance.

Workarounds

Disable OAuth2 providers in the PocketBase admin console until upgrades are applied.
Require manual administrator approval before any newly created OAuth2 account is treated as verified.
Restrict sign-up flows to a single OAuth2 provider where feasible to eliminate cross-provider auto-linking.

bash

# Upgrade PocketBase to a patched release
# For the 0.22.x branch
wget https://github.com/pocketbase/pocketbase/releases/download/v0.22.42/pocketbase_0.22.42_linux_amd64.zip

# For the 0.37.x branch
wget https://github.com/pocketbase/pocketbase/releases/download/v0.37.4/pocketbase_0.37.4_linux_amd64.zip

# Verify the running version
./pocketbase --version