Security/Services/AuthService.cs

@@ -183,8 +183,18 @@ public class AuthService(ICacheService cache, IAccessToken accessTokenService, I
     public Task<TwoFactorAuthenticator> LoginOAuthAsync(CookieOptions cookieOptions,
         HttpContext context,
         User user,
-        CancellationToken cancellation = default) =>
+        OAuthUser oAuthUser,
-            LoginAsync(cookieOptions, context, user, cancellation);
+        OAuthProvider provider,
+        CancellationToken cancellation = default)
+    {
+        if (user.OAuthProviders == null || !user.OAuthProviders.TryGetValue(provider, out var value))
+            throw new SecurityException($"This provider '{Enum.GetName(provider)}' is not linked to the account.");
+
+        if (value.Id != oAuthUser.Id)
+            throw new SecurityException("This account was not linked");
+
+        return LoginAsync(cookieOptions, context, user, cancellation);
+    }
 
     public async Task<TwoFactorAuthenticator> LoginAsync(CookieOptions cookieOptions,
         HttpContext context,