# OAuth account skips email verification

Compare verification and re-auth gates across every account-creation and linking path, not just direct signup

_Area: Web authentication and account takeover. Seen in 2 disclosed reports; latest 2023-03-03. Updated 2026-10-24._

## How it works
A product enforces an identity check (email verification, re-authentication, MFA) on its primary signup path, then assumes that check covers every way an account can come into existence. Alternate paths — OAuth/Connect onboarding, linked third-party identities, email-based support workflows — mint or act on accounts without passing through that gate. The broken assumption is "all accounts are equally verified"; in reality privilege state depends on which door the user came through.

## Where it shows up
- Multiple account-creation paths (direct signup vs OAuth/Connect vs SSO provisioning) with different post-creation states.
- Account-linking or "switch account" flows that accept a linked third-party session as proof of the primary identity.
- Email intake addresses (GDPR/data-rights, support, deletion) that act on the From address alone.
- Verification gates implemented in the signup handler rather than as a property of the account record.

## How to review
Enumerate every path that creates, links, or acts on an account, then compare the resulting account state and required checks for each. The invariant: an account's verified/privileged status must be a property of the account, enforced at every entry point, and any action that crosses a user boundary (switching identity, deleting, sending from a real address) must re-prompt for the primary credential or an out-of-band proof. For email-driven workflows, confirm sender identity is verified independently of the From header.

## Variants seen
- OAuth/Connect-created accounts skipped email verification yet got full live features, unlike gated classic signup [E1](https://bugbountylibrary.com/r/h1%3A1121896.md).
- Launcher treated possession of a linked Steam/Epic account as sufficient identity, allowing switch-in without primary credentials or MFA [E2](https://bugbountylibrary.com/r/h1%3A1235008.md).
- Spoofed email to a GDPR intake address triggered account deletion with no identity verification [E3](https://bugbountylibrary.com/r/h1%3A928255.md).

## Impact and severity
Full account takeover and unauthorized deletion; in E1, spoofed invoices from a real company's address. Severity rises when the bypassed gate protects money movement, destructive actions, or impersonation of a trusted brand, and when no re-auth exists anywhere on the alternate path.

## Why fixes fail
Gating only the signup handler leaves OAuth and linking paths open; the check must live on the account and be applied to every path, including email-driven workflows.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1121896.md
- E2: https://bugbountylibrary.com/r/h1%3A1235008.md
- E3: https://bugbountylibrary.com/r/h1%3A928255.md