# oauth-vulnerabilities

Published articles for oauth-vulnerabilities.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Stop Trusting the OAuth Email: How One Missing Check Enables Account Takeover in 2026

DevFeed: [Stop Trusting the OAuth Email: How One Missing Check Enables Account Takeover in 2026](<https://devfeed.tech/articles/stop-trusting-the-oauth-email-how-one-missing-check-enables-account-takeover-in-2026-99230.md>)

Original publisher: [Read original article](<https://hackernoon.com/stop-trusting-the-oauth-email-how-one-missing-check-enables-account-takeover-in-2026?source=rss>)

Author: viodex

Published: 2026-10-25T13:00:02Z

Content type: article

Language: en

Sources: [HackerNoon](<https://devfeed.tech/sources/hackernoon.md>)

Topics: [account takeover](<https://devfeed.tech/topics/account-takeover.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [trust](<https://devfeed.tech/topics/trust.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [password reset](<https://devfeed.tech/topics/password-reset.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [account](<https://devfeed.tech/tags/account.md>), [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [cves](<https://devfeed.tech/tags/cves.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [email](<https://devfeed.tech/tags/email.md>), [hackernoon-top-story](<https://devfeed.tech/tags/hackernoon-top-story.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-authentication](<https://devfeed.tech/tags/oauth-authentication.md>), [oauth-vulnerabilities](<https://devfeed.tech/tags/oauth-vulnerabilities.md>), [security](<https://devfeed.tech/tags/security.md>), [trust](<https://devfeed.tech/tags/trust.md>), [verification](<https://devfeed.tech/tags/verification.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web-security](<https://devfeed.tech/tags/web-security.md>)

### AI overview

OAuth login can bypass an application's email verification or enable account takeover when the application treats a provider's email claim as proof of ownership without checking its verification status and enforcing its own linking rules. The article describes varied outcomes with Discord OAuth: some clients reject unverified identities, some preserve their unverified state, and others accept them as verified. It cites Nhost's use of a nonempty email field instead of Discord's `verified` value, and a Better Auth flaw that checked the provider's verified-email claim but not the existing local account's verification state. Risks described include blind linking, unauthorized access, pre-account takeover, and privilege escalation, depending on the application's flows. The recommended safeguards are to understand each provider's guarantees, check its reliable verification status, keep provider and local verification states distinct, and require proof of account ownership before linking identities.

### Source excerpt

Explore OAuth Verification Trust Mismatch, a security issue caused by mismatch between OAuth providers and client applications