This vulnerability allows an attacker who knows a victim’s email address to pre‑create an unverified account using one OAuth2 provider, then, when the victim signs up with a different provider, the system automatically links that pre‑created account, promotes it to verified, and resets the old password. As a result, the attacker gains full control of the victim’s account, effectively bypassing authentication—an instance of CWE‑287, improper authentication.

Pocketbase versions earlier than 0.22.42 and 0.37.4 are affected. The product is the open‑source Pocketbase backend, and the flaw is present when the application allows OAuth2 authentication from multiple providers for a single user, which is often the default configuration.

The CVSS score of 6.1 indicates moderate severity, and the vulnerability is not listed in CISA KEV, implying limited public exploitation so far. The attack requires the attacker to know a victim’s email address, authenticate with one OAuth2 provider to pre‑create an unverified account, and wait until the victim logs in with a second provider; once these conditions are met, the attacker’s account is linked and granted full control.