Account takeover via unverified SSO linkage

Authentication bypass in 4ga Labs 4ga Boards before 3.3.8 allows remote attackers to take over accounts via SSO email linking. POST /api/register creates unverified local accounts for arbitrary email addresses, POST /api/access-tokens authenticates them while isVerified is false, and the get-create-one-for-github-sso.js, get-create-one-for-google-sso.js, get-create-one-for-microsoft-sso.js, and get-create-one-for-oidc-sso.js helpers bind a first SSO login to an existing account matched only by email. Exposure requires registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled plus a configured Google, GitHub, Microsoft, or OIDC provider; the attacker retains local-password access to the victim's linked account, projects, data, and permissions.