CVE-2026-63472: Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

ExternalAuthenticationService.createCustomerAndUser() links a newly-presented external (OAuth/social) authentication method to a pre-existing User account selected purely by email-address match, and it does so without requiring config.verified === true. If any configured AuthenticationStrategy forwards an email that was not proven to belong to the external identity (the classic email_verified omission — common with custom OAuth providers, or providers/strategies that don’t validate email ownership), an attacker can register at that provider using a victim’s email address, authenticate, and have their external identity bound to the victim’s existing Vendure account — resulting in account takeover.