Migrations/neko
1
0
Fork 0
mirror of https://github.com/m1k1o/neko.git synced 2026-11-03 00:11:48 -06:00
Code Issues Packages Projects Releases Wiki Activity
2,215 Commits 15 Branches 60 Tags
23d8a2718eea1a301cbe0cb1572d09d98cfb6dca
Commit Graph

1 Commits

Author SHA1 Message Date
Miroslav Šedivý 23d8a2718e oauth: ignore email when provider reports email_verified=false. 
An unverified email could match admin_emails/user_emails on providers that
let users set their own email. Only an explicit false is rejected; providers
that omit the claim are still trusted. Document the behavior.

Reported-by: Zachariah Mithani <zachariah@aplosai.com> (AploSec)
 2026-10-28 17:05:56 +01:00