From ceb0a1a8882a787da0c18dcd5801b6a4e2c16770 Mon Sep 17 00:00:00 2001
From: Raymond Jacobson <ray@audius.co>
Date: Wed, 5 Aug 2026 22:32:28 -0700
Subject: [PATCH] Fix OTP bypass account binding

---
 .../src/routes/authentication.js              |  7 +++++++
 .../test/authenticationTest.js                | 19 +++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/packages/identity-service/src/routes/authentication.js b/packages/identity-service/src/routes/authentication.js
index 712a7fc6de9..403702d9f51 100644
--- a/packages/identity-service/src/routes/authentication.js
+++ b/packages/identity-service/src/routes/authentication.js
@@ -253,6 +253,13 @@ module.exports = function (app) {
 
       const otpRequired = await requiresOtp({ email })
       if (!otpRequired) {
+        const associatedEmail = await getWalletAssociatedEmail({
+          req,
+          authUser: existingUser
+        })
+        if (!associatedEmail || email !== associatedEmail.toLowerCase()) {
+          return errorResponseBadRequest('Invalid credentials')
+        }
         return successResponse(existingUser)
       } else if (!otp) {
         // use email from registered address if available
diff --git a/packages/identity-service/test/authenticationTest.js b/packages/identity-service/test/authenticationTest.js
index 70b0ad650c0..c30295c95be 100644
--- a/packages/identity-service/test/authenticationTest.js
+++ b/packages/identity-service/test/authenticationTest.js
@@ -235,6 +235,25 @@ describe('test authentication routes', function () {
     assert.ok(otp)
   })
 
+  it('only bypasses otp for the associated review email', async function () {
+    const [authRecord, userRecord] = await signUpUser({
+      associateWallet: true
+    })
+    const email = 'testflight@audius.co'
+
+    await request(app)
+      .get('/authentication')
+      .query({ lookupKey: authRecord.lookupKey, email })
+      .expect(400, { error: 'Invalid credentials' })
+
+    await userRecord.update({ email })
+
+    await request(app)
+      .get('/authentication')
+      .query({ lookupKey: authRecord.lookupKey, email })
+      .expect(200)
+  })
+
   it('is case-insensitive for OTP code checks', async function () {
     await signUpUser()