All packsMulti-Tenant Auth & RBAC CoreSolve
sso auto link account by email takeover vulnerability
Auto-linking an SSO login by email is an account-takeover vector
Automatically attaching a new SSO identity to an existing account just because the emails match lets anyone who controls that email on the SSO side take over the account.
What goes wrong
If a user logs in via a new SSO provider and the app automatically links that login to an existing account purely because the email addresses match, then anyone who can create or control an account with that same email address on the SSO provider's side -- not necessarily the real account owner -- gets full access to the existing account the moment they "sign in with" that provider.
Why agents get it wrong
Auto-linking by email feels like good UX ("we recognized you, no extra step needed") and is a common pattern in tutorials that don't dwell on trust boundaries between identity providers -- the vulnerability requires reasoning about who actually controls a given email address on a third-party system, which is a security-specific concern outside what a feature-focused auth flow naturally surfaces.
What Multi-Tenant Auth & RBAC Core pre-decides
Core decision 16 states the rule as a hard never: never auto-link an SSO identity to an existing account by email. The v1 schema (auth_identities, keyed by provider + provider_user_id) has no linking flow implemented at all -- adding OIDC or SAML later means new identity rows and one login route, with account linking left as a deliberately unbuilt, separately-designed feature rather than an implicit default.
Source: ARCHITECTURE.md core decision 16