Accounts with an unverified email appear in emailed one-time codes

[metatablecatmaid (metatablecat)]

I recently had to sign into my phone using this method due to the main method refusing to work.

When I go to select my main Roblox account, a not very SFW account that I have never heard of shows up.

Curious, I decide to let myself into this account on a private window to find its using my email address unverified.

I hypothesise that for accounts that have a verified email which then attempt to use a new email, this wont work

Expected behavior

Accounts with unverified email addresses should not appear here, its a security loophole waiting to happen.

Note: While a private message was sent, its no longer applicable because the situation changed

[thirdtakeonit]

Thanks for the report! We’ll follow up when we have an update for you.

[wermnblkj]

Thank you for bringing up this issue. Currently, this is the intended behavior that users can log into/recover their accounts with unverified emails. This means someone may have mistakenly added your email to their account without verifying it.

While we don’t believe there’s a security risk in this situation (since you have control over the email), we understand how this can be confusing for the actual email owner.

The reason we allow unverified emails for login/recovery is to help more users get back to their accounts, as verifying emails are not mandatory on Roblox. But, in the future, we intend to explore a feature that would let users remove an account from their email if they receive a notification about an account that isn’t theirs. Thank you for your report!

[GaelPaws (gael)]

Can people get your account terminated through an enforcement ban by creating an account under the email and then self terminating the account? Would that trigger the enforcement ban system? This is a worry that me and others have. Thank you.