With a SSO plugin, account can be deleted with no verification

NodeBB version

v4.14.2

NodeBB git hash

f51197b773d863bfabf0f5e88d40df290f846889

NodeJS version

v22.21.0

Installed NodeBB plugins

No response

Database type

PostgreSQL

Database version

18.4.0

Exact steps to cause this issue

When NodeBB is run with login provider (like OAuth), users are prompted for their passwords when deleting their accounts, but the check for that password in processDeletion is entirely skipped, because no password is set locally and there is no indication of this.

This allows attacker to delete accounts with no verification if they get hold of session cookie (via XSS or similar vulnerability).

This is not currently a vulnerability, but if session-leaking vulnerability is found, this allows user account deletion on some NodeBB instances.

What you expected

There needs to be some form of verification when deleting an account even when SSO is in use, like forcing re-login a checking the session is fresh enough or something similar.

What happened instead

User is prompted for password when deleting their account, but any input is silently accepted.

Anything else?

No response