Unverified50% confidenceCautionExact time
If the identity provider has not verified the email, an attacker can change the email to the target user's address, and at login it will be linked to the existing account, leading to account takeover.
1
Sources
50%
Confidence
Long-term
Relevance
11/4/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe exposure of username-to-email address mappings can be used for cross-platform credential stuffing attacks, particularly against users who reuse the same password.79% similarUnverifiedNonexistent email and incorrect password should return the same message to prevent attackers from probing registered emails.77% similarUnverifiedThe existence of an account only proves that some identifier (such as an email address or phone number) has been registered in the system, and does not prove that the person using that account is who they claim to be.75% similarUnverifiedAfter a domain is flagged as an email service provider, users may face additional identity verification, reduced sending quotas, disabling of certain automated features, and even a greater likelihood of emails being classified as spam75% similarUnverifiedIn the scenario of OAuth email auto-linking, the attacker does not need to crack a password or phish; they only need to register an email address identical to the victim's at a provider that allows unverified emails and initiate one OAuth login to complete account takeover, and because the login goes through a legitimate OAuth flow, anomalies are often invisible in the logs.73% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1134491API
curl https://kongchang.com/api/v1/knowledge/claims/1134491MCP
get_claim(id=1134491)