A link may be established even when email_verified is false returned separately from the email claim

[jobannon]

Description

When the email_verified claim is present only in the id_token but the email claim is resolved by the response from the Userinfo endpoint, a link will still be established even when the email_verified claim is false.

Affects versions

>= 1.48.0

Steps to reproduce

1. Configure an IdP to link by email.
2. The email claim is returned in the Userinfo response.
3. The email_verified claim is returned in the id_token.
4. A link will be established.

Note that this only occurs when the email and email_verified claims are not present in the same payload. For example, if both claims are returned by the IdP in the Userinfo response, it works as designed. If both claims are returned by the IdP in the id_token and not the Userinfo it works as designed.

Expected behavior

A link should not be established when email_verified is false.

Related

• Add new default behavior to reject a link in an OIDC IdP if email_verified is present and is false #2423

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Additional context

Customer reported

[robotdan]

Internal:

• https://github.com/FusionAuth/fusionauth-app/pull/346