Three OAuth account takeovers, one bug: Auto-linking by email

Pingvin Share X, Better Auth and AshAuthentication each attached a stranger's OAuth sign-in to someone else's account. Here's how each check failed and what a safe linking decision looks like.