Expired Email link still Back to sign in feature allows to login

Hi @TULIKAR.09975 (Customer)​ , Thank you for reaching out to the Okta Community! 

This appears to be a security issue where the session state or authentication context is not being properly invalidated when an email verification link expires. When the user clicks "Back to sign in," the system may be retaining a partial authentication state or not enforcing the requirement for a fresh email verification, allowing login to proceed without a valid, current verification link.

Solution: This issue requires verification and remediation through official Okta Support, as it involves authentication flow integrity and potential security implications.

1. Document the exact reproduction steps: Record the complete flow: SSO login page selection, email verification method choice, wait time (15 minutes), expired link click, and "Back to sign in" button action.
2. Capture evidence: Take screenshots or screen recordings showing the "Email expired" message, the "Back to sign in" button, and the successful login that follows.
3. Note the authentication method: Confirm whether this occurs with all email verification methods or only specific ones (e.g., magic link vs. one-time code).
4. Check your Okta org's authentication policies: In the Admin Console, navigate to Security → Authentication Policies and review the email verification settings to understand the configured behavior.
5. Contact Okta Support: File a case with Okta Support and provide the reproduction steps, evidence, and your org configuration. Reference that this is a potential security issue affecting email verification link expiration enforcement. This requires account-specific investigation and may indicate a bug or misconfiguration in your tenant.

Regards.

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added