Unverified50% confidenceFactExact time
When the OAuth consent screen is in "Testing" status, only email addresses on the test user list can complete authorization, and other accounts see an "Access blocked" error page.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Step-by-Step Guide to Connecting Gmail to n8n with Custom Google OAuth
youtubeNeuralVarsity10/18/2026
Related Entities
Related Claims
UnverifiedSpecific strategies to prevent the OAuth email auto-linking vulnerability include: requiring the email to be verified, separating registration from linking, using a provider + provider_user_id combined identifier, secondary confirmation, and auditing and logging.69% similarUnverifiedIn the scenario of OAuth email auto-linking, the attacker does not need to crack a password or phish; they only need to register an email address identical to the victim's at a provider that allows unverified emails and initiate one OAuth login to complete account takeover, and because the login goes through a legitimate OAuth flow, anomalies are often invisible in the logs.68% similarUnverifiedOAuth 2.0规范将权限划分为不同scope，openid仅用于身份验证，email用于读取邮箱地址，https://mail.google.com/代表完整Gmail读写权限67% similarVerifiedRepeatedly registering trial accounts may violate Cursor's terms of service, and accounts may be subject to banning.65% similarUnverifiedIn the traditional OAuth authorization model, an application obtains an access token after the user approves on a consent screen, with the authorization decision made by the end user.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1061727API
curl https://kongchang.com/api/v1/knowledge/claims/1061727MCP
get_claim(id=1061727)