Two domain-ownership flaws exist when the SSO plugin is active. If domain verification is disabled, automatic organization assignment accepts unverified provider domains. This allows an authenticated organization owner or administrator to register an SSO provider for any domain, causing users with matching email domains to be added to the attacker's organization with default member permissions. If domain verification is enabled, a race condition occurs between the 'verify-domain' and 'update-provider' endpoints, which can apply a completed DNS proof to an incorrect domain. When combined with implicit account linking, this allows an attacker-controlled identity provider to be linked to an existing user account. The organization plugin must also be enabled for the organization assignment path to be exploited.