The affected asset is anonymised at the researcher's request.
Summary
The email change functionality requires email verification before allowing the account's email address to be updated.
However, the verification requirement can be bypassed by submitting an invalid verification code and then replaying the underlying UPDATE_USER_INFO GraphQL mutation without completing a successful verification.
Additionally, a previously captured email-update request can be reused with another authenticated session. The server accepts the request and updates the authenticated account's email address without requiring a fresh successful verification for the current email-change operation.
The newly assigned email address is then treated as verified and can be used to log in to the account.