Thanks @david it works with your version.
Nevertheless, I’m now welcomed by this modal (button label redacted)
oauth2 email verified setting is enabled.
Clicking again logs me in, but this is still an extra step for the user.
This method is in my discourse-oauth2-plugin fork, shouldn’t it stay stable as long as I don’t update the major version?