Unverified Email Registration and Google OAuth Account Collision Lead Pre ATO

Summary#

The application allows an attacker to register an email address that belongs to another user without verifying ownership of that email. If the legitimate owner subsequently signs up/logs in using Google OAuth with that same email address, the application associates the Google identity with the same existing account ID that was originally created by the attacker. As a result, the attacker retains access to the same account and does not need access to the victim's email account. The attacker can then perform security-critical actions, including changing the account email, verifying the attacker's email address, changing the password, and enabling 2FA, allowing the attacker to permanently take over the account and prevent the legitimate owner from accessing it.

Steps to Reproduce#

Attacker#

1. Create a new account using an email address that is not currently registered on the platform, for example: victim@example.com
2. Complete the normal signup process.
3. Do not verify the email address.
4. Confirm that the account can still be used even though the email remains unverified.
5. Record the account's Account ID.

Victim#

7. The legitimate owner of victim@example.com goes to the signup/login page.
8. Select Continue with Google.
9. Authenticate with the Google account whose verified email is victim@example.com.
10. The application authenticates the victim into the same account created by the attacker.
11. Verify that the Account ID is identical to the one recorded in step 5.

Attacker#

12. Using the attacker's existing authenticated session, access the same account.
13. Change the account email from victim@example.com to an attacker-controlled email address.
14. Verify the attacker-controlled email address.
15. Change the account password to an attacker-controlled password.
16. Enable 2FA using an attacker-controlled phone number, if applicable.
17. Log out and verify that the attacker can still authenticate using the newly controlled email/password and configured 2FA.
18. The legitimate owner can no longer regain control of the account through the original email address.