Sign up page is vulnerable to exploitation by malicious users

[t.fukao]

The user sign-up procedure is detailed below:

1. A user fills out email and password in Sign up page.
2. A new user account is created in Auth0 database.
3. A verification email is sent to provided email address.
4. The user clicks the link in the Verification email.
5. The user’s is_email_verified is set to true.

If a malicious user uses someone else’s email address in the first step, an account will be created without any consents.

I understand that the Verification email is implemented as safeguard against such malicious activities.
However, regardless of whether the user clicks the link in the Verification email, an account will be created in Auth0.

Creating accounts unilaterally, regardless of user consent, is a high-risk design that could lead to serious security vulnerabilities.

Ideally, accounts should only be created once the user clicks the link in the Verification email.
Is it possible?

[dawid.matuszczyk]

Hi @t.fukao

Welcome to the Auth0 Community!

Unfortunately, due to the Auth0 architecture, it’s not possible to create an account after email verification, but you can deny unverified users access to your application. We have a great Knowledge Solution about that → Best Practice of Enforcing Email Verification

Thanks
Dawid