Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

I'm using kratos and on register and update profile I got the verification screen but if redirect back without entering the OTP I can login and on profile my email is update. I think its a huge mess if I didn't wrong

there are hooks to control whether you can get a session after login without a verified email address

<https://www.ory.sh/docs/actions/require-verified-address>