Hack Any Outlook Account in Firebase Apps – Zero-Click Email Verification

If your app uses Firebase Auth email verification, enterprise Outlook users protected by Microsoft Defender Safe Links may already be getting their accounts auto-verified — without them ever opening an email. That flip of emailVerified = true can silently enable attackers to impersonate employees, trigger payouts, reset credentials, or walk through internal onboarding flows. This is a huge trust collapse between two widely used security features.