element-hq / element-hq/synapse
logging in with an SSO provider can steal the email address from another account
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#9437](https://github.com/matrix-org/synapse/issues/9437).
---
Suppose you have previously registered on a homeserver, and have associated an email address with that account.
Then you log in with an SSO login provider, with an account using the same email address, then the email address is silently removed from the old account and added to the new.
This could mean it is no longer possible to password-recover the original account.
Contributor guide
Research direction
Start by tracing the SSO login flow and the account email-association handling described in the issue. Reproduce the case with an existing homeserver account and an SSO account sharing its email address. Done means the original account retains a usable password-recovery email and the SSO login cannot silently remove it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100