Pre-Account takeover on Qwenchat online platform

[Madan301]

是否已有关于该错误的issue或讨论？ | Is there an existing issue / discussion for this?

• 我已经搜索过已有的issues和讨论 | I have searched the existing issues / discussions

该问题是否在FAQ中有解答？ | Is there an existing answer for this in FAQ?

• 我已经搜索过FAQ | I have searched FAQ

当前行为 | Current Behavior

An attacker, using only the victim's email ID, can sign up on behalf of the victim without any verification. Once the victim logs in, the attacker can access their chat data, files, and activity.

期望行为 | Expected Behavior

Link the email id and the authid that you are generating after the google oauth code grant flow.

复现方法 | Steps To Reproduce

Refer - [https://gofile.io/d/9mx2iL]

运行环境 | Environment

- OS:
- Python:
- Transformers:
- PyTorch:
- CUDA (`python -c 'import torch; print(torch.version.cuda)'`):

备注 | Anything else?

No response