No email verification leads to an Oauth account takeover.

Learn how to find this bug by reading this blog

Free link in the comments

👋 Hello all👋

So let’s see

After creating my account and logging into my account successfully.

I clicked on account settings

After I clicked on change email & password

Screenshot by author

After Entering a new email and my current password I clicked on Change email

Screenshot by author

You can see in the below image no confirmation link was sent.

Screenshot by author

My new email was changed without confirmation

Screenshot by author

I'm logged out from my account

Now I’m trying to log in with Google