Apple native sign-in should not verify client-supplied fallback email

[AnthonyRonning]

Summary

Apple native sign-in can create an email-verified OAuth user using a client-supplied email address when the Apple identity token does not include an email claim.

This is present on master and is independent of the AEAD/AAD seed-wrap hardening work.

Current behavior

In the Apple native sign-in flow, the server validates the Apple identity token and uses the token sub as the verified provider subject. For new users, if claims.email is missing, the flow falls back to request.email.

OAuth-created users are then treated as email-verified.

Risk

An attacker with a valid Apple identity token for their own Apple subject may be able to create a verified local account for an arbitrary unregistered email address by supplying that email in the request fallback field.

Existing registered emails appear to be blocked by the existing user checks, but unregistered email verification is still too trusting.

Suggested fix

For Apple native new-user creation:

• Accept only claims.email when Apple also asserts that email is verified.
• If falling back to request.email, treat it as unverified and require the normal email verification flow.
• Add a regression test for an Apple token without a verified email claim plus a client-supplied fallback email.