Unverified50% confidenceFactExact time
Although some mainstream OAuth providers such as Google return an email_verified field, not all providers enforce email verification, and developers need to formulate strategies based on the characteristics of the provider they use.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/12/2026
First Seen
Valid until: 1/10/2027
Sources
Related Entities
Related Claims
UnverifiedGoogle usually requires email verification before login, while the OIDC implementations of some self-hosted or niche providers allow users to set any unverified email; this inconsistency in verification policies across providers gives attackers an opportunity.79% similarUnverifiedOAuth 2.0规范将权限划分为不同scope，openid仅用于身份验证，email用于读取邮箱地址，https://mail.google.com/代表完整Gmail读写权限73% similarUnverifiedIn OIDC, email is merely an attribute declared by the provider and may be unverified; email_verified indicates that the provider has confirmed that the email is controlled by the current user, while sub or provider_user_id is the stable and hard-to-forge identity identifier.72% similarUnverifiedSpecific strategies to prevent the OAuth email auto-linking vulnerability include: requiring the email to be verified, separating registration from linking, using a provider + provider_user_id combined identifier, secondary confirmation, and auditing and logging.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008052API
curl https://kongchang.com/api/v1/knowledge/claims/1008052MCP
get_claim(id=1008052)