AIKIDO-2026-276117

TL;DR

fof/oauth's email sync listener and several providers use an OAuth provider's reported email as a confirmed address without checking whether the provider itself verified it. With update_email_from_provider enabled (the default), CheckAndUpdateUserEmail::handle() calls changeEmail() directly on every login or account link, replacing the forum account's email and leaving is_email_confirmed untouched, so an unverified provider reported address becomes a confirmed forum email. The GitHub provider's suggestions() similarly passes the public, unverified GET /user email to provideTrustedEmail(), letting that address log in to or link an existing forum account. The fix adds a getProviderVerifiedEmail() check per provider and passes provider driven email changes through Flarum's confirmation email flow instead of changing the email directly.