THREE OAUTH ACCOUNT TAKEOVERS, ONE BUG: AUTO-LINKING BY EMAIL

Summary from the TLDR InfoSec newsletter

Attackers took over accounts in Pingvin Share X, Better Auth, and AshAuthentication by abusing auto-linking, where an OAuth sign-in is attached to whichever existing account shares its email address. Each library skipped a different check: Pingvin ignored email_verified, Better Auth never verified the local account's email, and AshAuthentication never compared the two emails, though the writeup comes from WorkOS, which sells a competing auth product. Developers should look up identities by issuer and subject ID first, require verified emails on both sides, and make users prove they own the existing account, including MFA, before any link happens.