Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Summary With the per-provider OIDC emailfallback option enabled, Vikunja links an SSO login to a pre-existing local username+password account using only the email claim — no emailverified or Microsoft xmsedov check and no password check, on the unauthenticated callback. An attacker who can make t...