Logins from new OAuth accounts should not get automatically linked with logged in user

[jbwc]

We were noticing some odd behavior testing out our app where brand new gmail accounts were getting linked with another user. After digging into the code I found this block:

next-auth/packages/core/src/lib/callback-handler.ts

Lines 163 to 171 in a47b4ce

	if (user) {
	// If the user is already signed in and the OAuth account isn't already associated
	// with another user account then we can go ahead and link the accounts safely.
	await linkAccount({ ...account, userId: user.id })
	await events.linkAccount?.({ user, account, profile })
	// As they are already signed in, we don't need to do anything after linking them
	return { session, user, isNewUser }
	}

IIUC, If I get access to a computer that has an existing NextAuth session, I can essentially hijack that account by going through the login flow with my own email address.

Example:

User A logs into Website 1 on a public computer and forgets to log out.
Minutes later, User B goes to https://website1.com/login and uses their own email account.
User B's email is now linked to User A.

This seems like a bad thing, but I am curious your thoughts. At the very least, I would expect a setting to control this.