Linus Rath 5c1da4efa7 fix: refuse a pairing re-auth the identity provider did not make fresh ...

The step-up for SSO accounts asks the provider for a new login with
`prompt=login`, but a provider that ignores it answers from its existing
session, so anyone at an unlocked desktop could link a phone. When the
ID token's `auth_time` is older than the step-up, the re-auth is now
refused.

2026-09-27 04:49:54 +02:00

..

sso/complete

fix: refuse a pairing re-auth the identity provider did not make fresh

2026-09-27 04:49:54 +02:00