Unverified50% confidenceFactExact time
In OIDC, email is merely an attribute declared by the provider and may be unverified; email_verified indicates that the provider has confirmed that the email is controlled by the current user, while sub or provider_user_id is the stable and hard-to-forge identity identifier.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSpecific strategies to prevent the OAuth email auto-linking vulnerability include: requiring the email to be verified, separating registration from linking, using a provider + provider_user_id combined identifier, secondary confirmation, and auditing and logging.76% similarUnverifiedGoogle usually requires email verification before login, while the OIDC implementations of some self-hosted or niche providers allow users to set any unverified email; this inconsistency in verification policies across providers gives attackers an opportunity.76% similarUnverifiedAlthough some mainstream OAuth providers such as Google return an email_verified field, not all providers enforce email verification, and developers need to formulate strategies based on the characteristics of the provider they use.72% similarUnverifiedSending an email is not itself an idempotent operation; only after the email service provider accepts the request and returns a message ID can the email be confirmed as sent.71% similarUnverifiedAfter a domain is flagged as an email service provider, users may face additional identity verification, reduced sending quotas, disabling of certain automated features, and even a greater likelihood of emails being classified as spam70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008045API
curl https://kongchang.com/api/v1/knowledge/claims/1008045MCP
get_claim(id=1008045)