Email Change Validation Issue: Old Email Remains Usable After an Email Update

Overview

During testing of an email change functionality, I observed a potential authentication and account-management issue in which the previous email address remained usable for sign-in after the account's email address was changed.

After changing the account email address, authentication using both the previous and the new email address appeared to succeed.

This raises questions about how the application validates email changes, retires previous email addresses, and associates login identities with accounts.

Steps to Reproduce

1. Sign in to an account you own or are authorized to test.
2. Navigate to the account settings page.
3. Change the account's email address from the existing address to a new address.
4. Attempt to sign in using the previous email address.
5. Attempt to sign in using the new email address.
6. Record the results of both authentication attempts and verify whether they resolve to the same account.

Observed Behavior

After the email change, sign-in using both the old and new email addresses appeared to succeed.

This suggests that the email change process may not be invalidating the previous login identifier as expected, or that the application may be maintaining multiple valid sign-in identifiers.

Further testing is needed to determine whether both addresses authenticate to the same account, whether the old address remains an alias, and whether email verification is required before the new address becomes active.

Expected Behavior

After an email address is changed, the application should enforce a clear and consistent identity-verification policy.

Depending on the intended account model, the application should ensure that:

• The new email address is verified before being treated as the account's verified email.
• The previous email address is no longer accepted as a login identifier if it is intended to be retired.
• Login identifiers are consistently associated with the correct account.
• Email changes are protected against unauthorized modification and identity confusion.

Potential Security Impact

If the previous email address remains a valid login identifier after an email change, users and account owners may be confused about which address controls access to the account.

The security impact depends on the underlying authentication behavior. In particular, it is necessary to establish whether the old and new addresses authenticate to the same account and whether an unauthorized person can exploit this behavior.

Account takeover has not been established by the current reproduction steps alone.

Recommended Remediation

Review the email change and authentication flows to confirm that:

1. Email ownership verification is enforced as required by the application's security policy.
2. The account's canonical email and accepted login identifiers are updated consistently.
3. Retired email addresses cannot continue authenticating unexpectedly.
4. Existing sessions and recovery mechanisms follow the intended security policy after an email change.
5. Regression tests cover sign-in, password recovery, email verification, and account identity association after email changes.

Conclusion

The observed behavior indicates that the previous email address may remain usable for authentication after an email change. Further validation of account identity and verification behavior is required to determine the precise security impact and severity.