Unverified50% confidenceSolutionExact time
Specific strategies to prevent the OAuth email auto-linking vulnerability include: requiring the email to be verified, separating registration from linking, using a provider + provider_user_id combined identifier, secondary confirmation, and auditing and logging.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn the scenario of OAuth email auto-linking, the attacker does not need to crack a password or phish; they only need to register an email address identical to the victim's at a provider that allows unverified emails and initiate one OAuth login to complete account takeover, and because the login goes through a legitimate OAuth flow, anomalies are often invisible in the logs.78% similarUnverifiedIn OIDC, email is merely an attribute declared by the provider and may be unverified; email_verified indicates that the provider has confirmed that the email is controlled by the current user, while sub or provider_user_id is the stable and hard-to-forge identity identifier.76% similarUnverifiedWhen performing the delete action, the workflow actively excludes OTP (one-time password) emails and emails marked as protected to avoid accidentally deleting important information.73% similarUnverifiedOAuth 2.0规范将权限划分为不同scope，openid仅用于身份验证，email用于读取邮箱地址，https://mail.google.com/代表完整Gmail读写权限73% similarUnverifiedGoogle usually requires email verification before login, while the OIDC implementations of some self-hosted or niche providers allow users to set any unverified email; this inconsistency in verification policies across providers gives attackers an opportunity.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008050API
curl https://kongchang.com/api/v1/knowledge/claims/1008050MCP
get_claim(id=1008050)