While reviewing the user profile update workflow, I identified a validation and authorization issue in updateProfile() that allows modification of verification-related fields and bypasses the user schema validation layer.
The controller copies the incoming request body, removes only password, email, and _id, sanitizes the remaining payload, and directly updates the user document using $set.
However, the endpoint does not validate updates against the configured user schema and does not restrict verification-state fields that are used elsewhere in the authentication flow.
Verification fields such as:
emailVerifiedisVerifiedisverified
are actively used by the authentication and account-linking logic, but they are not removed or protected inside updateProfile().
As a result, authenticated users can submit updates containing verification-related fields, and those values are passed directly to the database update operation.
This creates an inconsistency where security-sensitive account state can be modified through a generic profile update endpoint instead of the dedicated verification workflow.
Additionally, because the endpoint does not use the same validation path as other data-update operations, user-configured schema constraints are not consistently enforced during profile updates.
While reviewing the user profile update workflow, I identified a validation and authorization issue in
updateProfile()that allows modification of verification-related fields and bypasses the user schema validation layer.The controller copies the incoming request body, removes only
password,email, and_id, sanitizes the remaining payload, and directly updates the user document using$set.However, the endpoint does not validate updates against the configured user schema and does not restrict verification-state fields that are used elsewhere in the authentication flow.
Verification fields such as:
emailVerifiedisVerifiedisverifiedare actively used by the authentication and account-linking logic, but they are not removed or protected inside
updateProfile().As a result, authenticated users can submit updates containing verification-related fields, and those values are passed directly to the database update operation.
This creates an inconsistency where security-sensitive account state can be modified through a generic profile update endpoint instead of the dedicated verification workflow.
Additionally, because the endpoint does not use the same validation path as other data-update operations, user-configured schema constraints are not consistently enforced during profile updates.