# Third-party accounts log into an account without verification

**URL:** <https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654>\
**Category:** Feature\
**Created:** [4 Septiembre, 2014 22:22 UTC](https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654 "2014-09-04T22:22:47Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![stuartpb](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stuartpb/32/122134_2.png) [@stuartpb](https://meta.discourse.org/u/stuartpb)\
**Post date:** [4 Septiembre, 2014 22:22 UTC](https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654/1 "2014-09-04T22:22:47Z")

</div>

From what I can tell, if I’ve already created an account with my email address (say, via GitHub), then I sign out, then sign in in via another service (such as Facebook) where I have the same e-mail, I’m logged in to my Discourse account with no further steps.

Here’s why this is a bug:

Say Alice has an email address, and a Facebook account, but not a Twitter account. She signs up for an account in Discourse using her Facebook account.

Later, Eve creates a Twitter account with Alice’s email address. Twitter lets you use an account without verifying the email address, so she then signs in to Discourse with this Twitter account. Discourse sees this Twitter account has the same email as Alice, and so logs Eve in as Alice.

Associating a new endpoint with an existing account should require verification from an already-authorized endpoint.

---

_[View the full topic](https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654)._