fix(auth): close nOAuth account takeover via email-based OAuth linking#5156

Merged

waleedlatif1 merged 3 commits into

worktree-fix+noauth-account-linking

Jun 20, 2026

Commits on Jun 20, 2026

fix(auth): close nOAuth account takeover via email-based OAuth linking
waleedlatif1
committed
test(auth): cover Microsoft id-token emailVerified derivation
waleedlatif1
committed
fix(auth): check the provider field the sign-in handler actually uses
waleedlatif1
committed