Three OAuth account takeovers, one bug: Auto-linking by email
Blog post from WorkOS
Multiple 2026 vulnerabilities in Pingvin Share X, Better Auth, and AshAuthentication showed how OAuth/OIDC account linking based on matching email addresses can enable account takeover when applications fail to verify all ownership conditions. Pingvin Share X trusted unverified email claims from generic OIDC providers and could bypass enrolled TOTP, Better Auth linked a verified provider identity to an unverified local account created by an attacker, and AshAuthentication failed to confirm that the provider email matched the existing account before overwriting account data. Related WordPress plugin flaws also demonstrated risks in OAuth callback handling, including missing state and nonce validation and replayable ID tokens. Safe identity linking should prioritize the stable issuer-subject identifier pair, treat email as only a hint, require verified and matching emails on both provider and local-account sides, trust verification only from authoritative issuers, preserve existing account settings, enforce MFA, notify users of new sign-in methods, and ensure all callback validations fail closed.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.