Pingvin Share X, Better Auth and AshAuthentication each attached a stranger’s OAuth sign-in to someone else’s account. Here’s how each check failed and what a safe linking decision looks like.
Three OAuth account takeovers, one bug: Auto-linking by email
calendar_today
October 12, 2026
domain
workos