One Email, Two Logins — Four Account Takeover Paths When Integrating Google Sign-In with Node.js

For any system that supports both "email + password" and "Google Sign-In" (or any other third-party login), the possible states of a user identity get noticeably more complex than with a single login method — and that complexity often leaves exploitable holes behind.

Using a member system (Node.js + Express + TypeScript + MongoDB) as the case study, this talk walks through four classic account takeover paths and the corresponding fixes:

1. Blocking Google from silently taking over an account that already has a password
2. How a Google-only user can safely add a password later
3. Unbinding before account deletion to avoid orphan bindings
4. Pre-account hijacking — the attack path that strikes before the account is even created

Hope this serves as a useful reference for anyone currently integrating any kind of third-party login.