CVE-2026-35511

Name of the Vulnerable Software and Affected Versions Authorizer (affected versions not specified)

Description An account linking flaw exists where the OAuth callback handler links incoming OAuth identities to existing accounts based on email addresses without verifying if the existing account's email was previously verified. An attacker can pre-register an account using a victim's email address without verifying it. When the actual owner later logs in via a supported OAuth provider, the system links the verified OAuth identity to the attacker's unverified account and automatically marks the email as verified. Because the attacker's original password remains valid and is not invalidated during this process, the attacker gains persistent password-based access to the victim's account. This issue affects all configured OAuth providers, including Google, GitHub, Facebook, Apple, LinkedIn, Twitter, Discord, Twitch, Roblox, and Microsoft. The vulnerability is located in the internal/http handlers/oauth callback.go file, specifically within the logic that handles GetUserByEmail and UpdateUser functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict the use of OAuth identity linking for accounts that have not yet verified their email addresses. When linking a new OAuth identity to an existing account, invalidate any existing password associated with that account.