Medium SeverityAuthenticationOAuth2Security

The Unverified Local Account Hijack

1.The Symptom (The Chaos)

Legitimate users logging in via 'Sign in with Google' are silently merged into existing unverified local accounts, giving attackers password access to social profiles. (local account = Email/Password Login)

2.The Trigger Condition

An attacker pre-registers an unverified account using a target's email, and the victim subsequently authenticates using an OAuth2 provider with that same email.

3.The Catch (Why it broke)

We assumed matching email addresses across local accounts and social providers implied identity ownership, failing to realize that unverified local accounts allow attackers to squat on target emails prior to social login.

4.Architectural Trade-offs

To resolve this, we block auto-linking on provider mismatches and require manual password confirmation—trading frictionless multi-provider linking for complete immunity against account takeovers.

service/AuthService.java

[Implicit Provider Auto-Linking]

// VULNERABLE: Auto-links OAuth2 profiles to local accounts by email alone.
// Unverified local accounts allow attackers to squat on target emails and hijack accounts.
User user = userRepository.findByEmail(email)
        .map(existing -> {
            existing.setProviderId(providerId); // <--- Unsafe link without provider check!
            return userRepository.save(existing);
        })
        .orElseGet(() -> createNewSocialUser(email, name, provider, providerId));