Failed OAuth Login attempts generate "A new user registered and needs approval" email notification

Description:

I have the following combination of settings:

OAuth is enabled using Google SSO, this is the only login method

Default login form is disabled: Accounts_ShowFormLogin Disabled
Registration Disabled: Accounts_RegistrationForm Disabled
Manual Approval Enabled: Accounts_ManuallyApproveNewUsers Enabled
Accounts registration with authentication services disabled: Accounts_Registration_AuthenticationServices_Enabled Disabled

Additionally I have configured a mailer to send email notifications to administrators.

In theory, this should mean that:

• Nobody can register
• Only pre-registered users can sign in with OAuth
• Server will reject failed OAuth login attempts

Instead, for EVERY failed oauth login attempt (not signup, signups are disabled), I receive an email saying:

The user () has been registered.
Please check "Administration -> Users" to activate or delete it.

The above quote has not been edited - there is no username or email mentioned, just the () brackets.

It doesn't seem like any new users are created (I see no additional entries in the list).

Steps to reproduce:

Configure settings as described in "Description" section. Set up a mailer to send email notifications.

Get an unregistered user to use Google SSO to sign into the instance.

Expected behavior:

Login is rejected, no user is (attempted to be) created, no email is sent (although failed attempts are logged).

Actual behavior:

Login is rejected, for every failed login attempt, rocketchat will send a "New user has been registered and requires approval" email to all administrators.

Server Setup Information:

• Version of Rocket.Chat Server: 3.11.1
• Operating System: Linux,
• Deployment Method: Docker
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version: 3.6

Client Setup Information

• Desktop App or Browser Version: Any
• Operating System: Any

Additional context

Relevant logs:

Failed login detected - Username[unknown] ClientAddress[REDACTED] ForwardedFor[REDACTED] XRealIp[REDACTED] UserAgent[Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36]

Reproduce the issue with Google SSO and the listed Accounts settings, then trace the failed OAuth login and administrator email notification paths. Verify whether a failed login creates or treats an empty user as newly registered; done means the login is rejected, no registration email is sent, and the failed attempt remains logged.