Unverified50% confidenceFactExact time
Google usually requires email verification before login, while the OIDC implementations of some self-hosted or niche providers allow users to set any unverified email; this inconsistency in verification policies across providers gives attackers an opportunity.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/12/2026
First Seen
Valid until: 1/10/2027
Sources
Related Entities
Related Claims
UnverifiedAlthough some mainstream OAuth providers such as Google return an email_verified field, not all providers enforce email verification, and developers need to formulate strategies based on the characteristics of the provider they use.79% similarUnverifiedIn OIDC, email is merely an attribute declared by the provider and may be unverified; email_verified indicates that the provider has confirmed that the email is controlled by the current user, while sub or provider_user_id is the stable and hard-to-forge identity identifier.76% similarUnverifiedMany online services do not enforce an email verification process during user registration, allowing users to complete registration with an email address that does not belong to them.75% similarUnverifiedUsing disposable email addresses to register accounts in bulk to circumvent payment restrictions may violate Google's Terms of Service and carries the risk of account suspension.74% similarUnverifiedAfter a domain is flagged as an email service provider, users may face additional identity verification, reduced sending quotas, disabling of certain automated features, and even a greater likelihood of emails being classified as spam74% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008047API
curl https://kongchang.com/api/v1/knowledge/claims/1008047MCP
get_claim(id=1008047)