CWE-1470 Improper External Identity Verification

The product supports user accounts that include a user's external identifier or communications channel - such as email, phone number, social media account, or domain name - but it does not properly verify that the user actually controls the associated identifier or channel.

• Access Control, Authentication: Gain Privileges or Assume Identity, Bypass Protection Mechanism — If an external identifier is controlled by an attacker, such as an email address, then the attacker might be able to perform a "pre-hijacking attack" against a victim who creates or recovers their account.

• [Architecture and Design, Implementation] Before changing the contact information, send a message to the user with a confirmation code. Only make the change when the user provides the correct code. Ensure that the confirmation code is expired and rendered invalid if the user does not respond quickly enough.