CVE-2026-62367: Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

With the per-provider OIDC emailfallback option enabled, Vikunja links an SSO login to a pre-existing local (username+password) account using only the email claim — no email_verified (or Microsoft xms_edov) check and no password check, on the unauthenticated callback. An attacker who can make the configured issuer emit a token bearing a victim’s email logs in as that victim with a full session and no victim interaction (the nOAuth / Grafana CVE-2023-3128 class). The 2.3.0 fix for GHSA-8jvc-mcx6-r4cg added a TOTP gate, not an email_verified gate, so users without TOTP remain exposed.