SSO account hijack via identity attribute mass assignment

Authentication bypass in RARgames 4gaBoards before 3.3.9 lets remote authenticated users misbind a victim's first SSO login. The PATCH /api/users/:id handler in server/api/controllers/users/update.js whitelists backend-managed sso* identity fields from user input, and SSO helpers such as server/api/helpers/users/get-create-one-for-github-sso.js then trust the stored provider ID for direct account lookup. Exploitation requires a normal account, a victim provider identifier, and a victim-initiated first SSO login; afterward, projects, boards, or other data that the victim creates in the attacker-owned account remain available through the attacker's original local credentials.