# Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

Vendure's ExternalAuthenticationService links external OAuth logins to existing accounts by email alone, ignoring the verified flag, enabling account takeover.

- Payout: Research
- Severity: critical
- Program: Vendure
- Found by: squinard1478
- Disclosed: 2026-09-17
- CVE: CVE-2026-63472
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6j36-r6pr-59x4
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-6j36-r6pr-59x4
- Tags: area:web domain:web impact:ato kind:research platform:ghsa sev:critical tech:oauth technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** ExternalAuthenticationService.createCustomerAndUser in @vendure/core
**Root cause:** createCustomerAndUser looks up an existing User by email and attaches the new ExternalAuthenticationMethod without checking config.verified, so an unverified external email is bound to a pre-existing account.
**Steps:**
1. Victim has native Vendure account `victim@example.com`.
2. Attacker authenticates via configured external provider presenting `emailAddress = victim@example.com` with `verified` unset/false.
3. `createCustomerAndUser` finds victim's User by email and attaches attacker's `ExternalAuthenticationMethod`.
4. Attacker logs in via that external method and is authenticated as the victim.
**How found:** Code review of createCustomerAndUser: noticed config.verified only sets User.verified and a history entry, never gating the existingUser branch that attaches the external method.
**Exploitation:** Attacker registers at an external provider using the victim's email (provider not enforcing email ownership), authenticates through the store's external strategy, and the resulting external method is silently bound to the victim's existing Vendure account, granting full session as the victim.
**Insight:** In federated/social login code, audit whether the verified/email_verified flag gates account linking, not just account creation — the merge-by-email branch is where takeover lives.