CVE-2026-44166: Github.com/pocketbase/pocketbase PocketBase Vulnerable To Account Pre-hijacking Vulnerability
MODERATECVE-2026-44166 is a MODERATE pocketbase vulnerable to account pre-hijacking vulnerability (CWE-287: Improper Authentication) affecting Github.com/pocketbase/pocketbase libraries in the Go ecosystem. The issue involves pocketbase vulnerable to account pre-hijacking via oauth2 unverfied->verified autolinking upgrade. Remediation is available by upgrading affected packages to version 0.22.42, 0.37.4.
CVE-2026-44166 at a Glance
How to Fix CVE-2026-44166
To remediate this vulnerability, upgrade all affected Github.com/pocketbase/pocketbase dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/pocketbase/pocketbase to 0.22.42Upgrade github.com/pocketbase/pocketbase to 0.37.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/pocketbase/pocketbaseHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-44166, inspect your project dependencies for Github.com/pocketbase/pocketbase:
inspect dependencies for github.com/pocketbase/pocketbaseAnalyze the terminal output to locate any version of Github.com/pocketbase/pocketbase in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.22.42), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-287: Improper Authentication, where when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. In Github.com/pocketbase/pocketbase, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-44166 Affected Github.com/pocketbase/pocketbase Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/pocketbase/pocketbase
|
Go |
< 0.22.42
|
0.22.42
|
|
github.com/pocketbase/pocketbase
|
Go |
≥ 0.30.0
< 0.37.4
|
0.37.4
|
References
Frequently Asked Questions
What is CVE-2026-44166?
Which Github.com/pocketbase/pocketbase versions are affected?
What version fixes CVE-2026-44166?
Is github.com/pocketbase/pocketbase affected?
What CWE is associated with CVE-2026-44166?
How can I check Go dependencies for CVE-2026-44166?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-pq7p-mc74-g65w",
"modified" : "2026-05-13T16:26:55Z",
"published" : "2026-05-05T21:17:19Z",
"aliases" : [ "CVE-2026-44166" ],
"summary" : "PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade",
"details" : "A pre-hijacking issue was discovered with the OAuth2 autolinking by [Alardiians](https://github.com/Alardiians).\n\nIn some situations, if an attacker knows the email address of the victim they can create and link an **unverified** PocketBase user in advance by authenticating with one of the OAuth2 app providers, e.g. \"A\". When the victim gets invited or decides to sign up to your app on their own with provider \"B\" _(PocketBase OAuth2 auth requires to be with a different provider because we don't allow multiple OAuth2 accounts from the same provider to be associated to a single PocketBase user)_, the user created previously by the attacker will be autolinked, upgraded to **\"verified\"** and its old password reset.\n\nThe upgrade flow operates within the expectations but the problem is that I forgot to clear the previous OAuth2 link(s) leaving the attacker to still have access to the initially created user.\n\nOr in other words, the vulnerability is similar to the [mixed password + OAuth2 auth pre-hijacking issue](https://github.com/pocketbase/pocketbase/security/advisories/GHSA-m93w-4fxv-r35v) that we had in the past but with a slightly different angle.\n\nSo with that in mind, and to avoid introducing breaking changes to the auth flows, a new fix was applied that automatically deletes all such pre-existing OAuth2 links on \"unverified\" to \"verified\" upgrades.\n\n**While the vulnerability requires some prerequisites, it is considered severe and it is strongly recommended to upgrade to v0.37.4 _(or to v0.22.42 if you are using an older <v0.23.0 release)_.**",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/pocketbase/pocketbase"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.22.42"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/pocketbase/pocketbase"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.30.0"
}, {
"fixed" : "0.37.4"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44166"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pocketbase/pocketbase"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-287" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-05T21:17:19Z",
"nvd_published_at" : "2026-05-12T18:17:29Z"
}
}