ControlPlane AI Security Team Reports a Teacher Account-Linking Weakness

Summary

ControlPlane's AI security research team found that the Department for Education's teacher application service could overwrite an account's existing login association. Code intended to connect a new sign-in method to an application didn’t verify that another login was already associated.

The later correction rejected that conflict while allowing applicants to link an account for the first time.

Once reported, the Department for Education confirmed the issue and remediated it. Severity was assessed as High, CVSS 7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), classified under CWE-287 (Improper Authentication).

Background

The service handles applications for qualified teacher status (QTS) in England (opens in a new tab). Applicants previously signed in through links sent to their email address. Adding GOV.UK One Login (opens in a new tab), the government's shared sign-in service, required a way to connect those existing applications to the new login.

The sign-in service supplies a subject identifier (opens in a new tab): a stable reference for the user's account within that identity provider. The application stores that reference to recognise the user on later visits.

The finding

The code first searched for a teacher record using the incoming subject identifier (opens in a new tab). If none matched, it searched by email instead. It then wrote the incoming identifier to the record, even if a different identifier was already stored there.

The team created a new sign-in account using the email address of its own teacher account, which had not been linked before. Completing email verification opened the existing application dashboard.

That demonstrated first-time linking, not the replacement of an existing login. The programme also noted that mailbox access already allowed the tester to sign in through the original email-link method.

Root cause

An email match was used both to find an existing application and to permit a change to its login association. The missing decision was what to do when that association already existed.

The OpenID Connect identity standard (opens in a new tab) treats the identity provider and subject identifier (opens in a new tab) together as the stable user reference. An email address has no equivalent guarantee: it can change or be reassigned.

Potential impact

Replacing the stored identity could change who could sign in to an application that contains personal details, qualifications, employment history and identity documents. This was the risk in the code; the test didn’t demonstrate a separate account-takeover route or displace another applicant's login.

Coordinated disclosure and remediation

By Aug 4, 2026, source review found a check rejecting a new association when the teacher record already held a conflicting identity. First-time linking remained available. The Department for Education subsequently confirmed that the behaviour had been addressed.

Disclosure timeline, the deployment date and a live retest of the correction are not recorded. Times below are UTC.

• Jun 26, 2026, approx. 04:20 to 04:40 UTC: An unattended agent doing discovery work linked a new sign-in to the team's existing teacher application by email.
• Jun 26, 2026, 17:30:32 UTC: ControlPlane triaged the agent’s finding and prepared the report.
• Jun 26, 2026, 19:02:52 UTC: Report submitted with controlled-account evidence.
• Jun 29, 2026, 13:21:47 UTC: Programme noted that mailbox access already permitted sign-in.
• Aug 4, 2026, 13:27:21 UTC: Source review recorded the check against replacing an existing identity.
• Sept 23, 2026, 12:03:15 UTC: Programme resolved the report.

Responsible testing and data handling

Testing followed the GC3 Vulnerability Disclosure Policy (opens in a new tab), which anyone who finds a vulnerability in a public sector service can use. The mailbox and teacher account belonged to the research team. No third-party applicant data was accessed.

The broader lesson

Account-linking tests require both an already-linked account and a new one. A rejected attempt must leave the existing association intact, while normal repeat sign-in continues to work.

About this work

ControlPlane is an AI-native cybersecurity consultancy specialising in cloud native security, secure software supply chains, and the assurance regimes that regulated organisations depend on. We help teams design and secure platforms and non-human identities without sacrificing usability. If you are building cloud services that must remain both open and safe, we would be happy to talk.