authentication 1 OAuth Account Takeover: Exploiting Email Change Without Re-authentication Oct 13, 2025