# OAuth email claim trusted without verification

Login authorizes on OAuth/OIDC email or domain claim without checking email_verified or org membership

_Area: Web authentication and account takeover. Seen in 5 disclosed reports; 2 confirmed bounties: $1,000 and $1,337; latest 2026-10-09. Updated 2026-10-23._

## How it works
A login handler treats the email (or email domain) returned by an OAuth/OIDC/OneTap flow as proof of identity. The broken assumption: that the identity provider only asserts an address the user actually controls. Providers assert addresses users do not own — an arbitrary existing address on a non-Gmail Google account [E2](https://bugbountylibrary.com/r/blog%3Atrufflesecurity-com-blog-google-oauth-is-broken-sort-of.md), a client-supplied email parameter [E3](https://bugbountylibrary.com/r/h1%3A245408.md), an email under a domain claimed in an unverified Workspace trial [E4](https://bugbountylibrary.com/r/h1%3A671406.md), or an admin-assigned address [E5](https://bugbountylibrary.com/r/h1%3A617896.md). The handler maps that string to an existing account and issues a session.

## Where it shows up
- Login code reads `email`, `hd`, or a domain suffix from the token/response and looks up or creates a user by it.
- No read of `email_verified` (or `xms_edov`) before trusting the claim [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xv7q-fvmc-jx96.md)[E4](https://bugbountylibrary.com/r/h1%3A671406.md).
- Authorization keyed on email domain rather than an org-membership claim [E2](https://bugbountylibrary.com/r/blog%3Atrufflesecurity-com-blog-google-oauth-is-broken-sort-of.md).
- Account-linking fallback that matches an SSO identity to a local account by email alone [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xv7q-fvmc-jx96.md).
- Mobile/API OAuth endpoints accepting an email field instead of a provider token [E3](https://bugbountylibrary.com/r/h1%3A245408.md).

## How to review
Trace the login path from provider response to session issuance. Two invariants must hold separately:
1. Verified email: the session is created only for an address the provider marks verified (`email_verified`/`xms_edov` true).
2. Verified org claim: where domain-based access is granted, authorization uses an org-membership claim (e.g. Google `hd`), not the email suffix [E2](https://bugbountylibrary.com/r/blog%3Atrufflesecurity-com-blog-google-oauth-is-broken-sort-of.md).

Check the server validates the provider token itself and never trusts a client-supplied email [E3](https://bugbountylibrary.com/r/h1%3A245408.md). Check the account-linking fallback does not resolve on email alone [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xv7q-fvmc-jx96.md). Confirm off-boarding revokes access, since a stale email claim outlives employment [E2](https://bugbountylibrary.com/r/blog%3Atrufflesecurity-com-blog-google-oauth-is-broken-sort-of.md).

## Variants seen
- Plus-addressed corporate email on a personal Google account passes domain checks [E2](https://bugbountylibrary.com/r/blog%3Atrufflesecurity-com-blog-google-oauth-is-broken-sort-of.md).
- Endpoint trusts a raw email parameter and skips token validation entirely [E3](https://bugbountylibrary.com/r/h1%3A245408.md).
- Unverified Workspace domain claim mints an identity for the victim's email [E4](https://bugbountylibrary.com/r/h1%3A671406.md).
- IdP admin sets arbitrary emails, so the claim is not proof of ownership [E5](https://bugbountylibrary.com/r/h1%3A617896.md).
- OIDC email-fallback links SSO to a local account without checking `email_verified` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xv7q-fvmc-jx96.md).

## Why fixes fail
Fixes that only tighten string or domain matching still fail: E2 and E4 show the provider asserts addresses the user does not control, so the fix must move to verified-email and org-membership claims, not stricter matching.

## Impact and severity
Full account takeover in E3 and E4; persistent unauthorized access after off-boarding in E2; local-account takeover in E1; arbitrary-domain signup in E5. High severity: the flaw sits on the primary login path and needs no victim interaction beyond knowing their email. It worsens when the same claim gates admin or org-wide resources.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-xv7q-fvmc-jx96.md
- E2: https://bugbountylibrary.com/r/blog%3Atrufflesecurity-com-blog-google-oauth-is-broken-sort-of.md
- E3: https://bugbountylibrary.com/r/h1%3A245408.md
- E4: https://bugbountylibrary.com/r/h1%3A671406.md
- E5: https://bugbountylibrary.com/r/h1%3A617896.md