# Unverified email account linking takeover

Does every email-keyed link, invite, or OAuth grant require a verified email server-side?

_Area: Web authentication and account takeover. Seen in 13 disclosed reports; 6 confirmed bounties, median $3,000, range $800-$5,000; latest 2026-09-17. Updated 2026-10-23._

## How it works
Systems treat an email string as proof of identity before anyone has proven control of that mailbox. An account, invite, OAuth grant, or identity link is keyed to an email, and the verification gate lives only in the UI or is skipped on some path. Anyone who registers the victim's email (unverified) inherits whatever that email is entitled to: pending invites, linked identities, OAuth codes, or pre-existing accounts. Two shapes recur: a verification gate that exists in the UI but not on the backend handler [E1](https://bugbountylibrary.com/r/h1%3A922456.md)[E8](https://bugbountylibrary.com/r/h1%3A1018489.md), and an identity-binding path that trusts an email field or a "verified" flag the server never actually proved [E2](https://bugbountylibrary.com/r/h1%3A867513.md)[E5](https://bugbountylibrary.com/r/h1%3A1551176.md)[E6](https://bugbountylibrary.com/r/h1%3A906790.md).

## Where it shows up
- OAuth authorize/token handlers that issue codes without checking email verification [E1](https://bugbountylibrary.com/r/h1%3A922456.md).
- Invite acceptance (org owner, team, creator) not requiring the invitee's email to be verified [E3](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-github-org-takeover.md).
- Identity migration or new signup paths binding a new ID to a pre-existing email-keyed account [E7](https://bugbountylibrary.com/r/h1%3A1679734.md).
- Invite acceptance that auto-flips an email to verified without mailbox proof, then SSO maps by email [E4](https://bugbountylibrary.com/r/h1%3A2037902.md).
- Account-update endpoints accepting undocumented `email`/`verified` fields (mass assignment) [E5](https://bugbountylibrary.com/r/h1%3A1551176.md).
- Profile update endpoints honoring a client-supplied email the UI disables [E6](https://bugbountylibrary.com/r/h1%3A906790.md).
- Secondary admin GraphQL endpoints mutating identity fields without confirmation [E2](https://bugbountylibrary.com/r/h1%3A867513.md).
- External-login connect endpoints missing the verification gate the UI copy promises [E8](https://bugbountylibrary.com/r/h1%3A1018489.md).

## How to review
The invariant: no account, grant, invite, or link keyed to an email may be created, accepted, or acted upon until control of that email is proven server-side. For each state-changing endpoint (authorize POST, invite accept, external-login connect, account PATCH, signup binding), confirm the server independently enforces verification, not just the UI [E1](https://bugbountylibrary.com/r/h1%3A922456.md)[E8](https://bugbountylibrary.com/r/h1%3A1018489.md). Confirm linking matches on a verified identifier, not raw email. Check whether `email`/`verified` can be mass-assigned or bound from a disabled UI field [E5](https://bugbountylibrary.com/r/h1%3A1551176.md)[E6](https://bugbountylibrary.com/r/h1%3A906790.md). For invites, check whether the pending invitation is acceptable server-side before verification [E3](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-github-org-takeover.md). Audit every path that can flip an email to verified, since SSO-by-email turns any of them into takeover [E4](https://bugbountylibrary.com/r/h1%3A2037902.md). Note the gate families differ: OAuth/external-login gates [E1](https://bugbountylibrary.com/r/h1%3A922456.md)[E8](https://bugbountylibrary.com/r/h1%3A1018489.md) versus invite/pending-account gates [E3](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-github-org-takeover.md)[E4](https://bugbountylibrary.com/r/h1%3A2037902.md)[E7](https://bugbountylibrary.com/r/h1%3A1679734.md).

## Variants seen
- UI-only verification gate bypassed by direct POST to authorize endpoint [E1](https://bugbountylibrary.com/r/h1%3A922456.md).
- Pending invite claimed by unverified account with invitee's email [E3](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-github-org-takeover.md).
- New signup path binds to pre-existing email-keyed account without verification [E7](https://bugbountylibrary.com/r/h1%3A1679734.md).
- Invite acceptance auto-flips email to verified, then SSO maps by email [E4](https://bugbountylibrary.com/r/h1%3A2037902.md).
- Mass-assignment of email/verified flag [E5](https://bugbountylibrary.com/r/h1%3A1551176.md).
- Client-supplied email trusted on profile update [E6](https://bugbountylibrary.com/r/h1%3A906790.md).
- Secondary admin endpoint mutates email; downstream merge trusts it [E2](https://bugbountylibrary.com/r/h1%3A867513.md).
- External-login connect endpoint skips verification gate [E8](https://bugbountylibrary.com/r/h1%3A1018489.md).

## Impact and severity
Full account takeover of third-party accounts, org takeover, and impersonation [E1](https://bugbountylibrary.com/r/h1%3A922456.md)[E3](https://bugbountylibrary.com/r/blog%3Aabss-me-posts-github-org-takeover.md)[E4](https://bugbountylibrary.com/r/h1%3A2037902.md)[E7](https://bugbountylibrary.com/r/h1%3A1679734.md). Worse when accounts are keyed solely by email, when pending-state accounts exist as a distinct target class, and when linking is implicit rather than user-confirmed.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A922456.md
- E2: https://bugbountylibrary.com/r/h1%3A867513.md
- E3: https://bugbountylibrary.com/r/blog%3Aabss-me-posts-github-org-takeover.md
- E4: https://bugbountylibrary.com/r/h1%3A2037902.md
- E5: https://bugbountylibrary.com/r/h1%3A1551176.md
- E6: https://bugbountylibrary.com/r/h1%3A906790.md
- E7: https://bugbountylibrary.com/r/h1%3A1679734.md
- E8: https://bugbountylibrary.com/r/h1%3A1018489.md