Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Ran into an interesting bug. Don't have screenshots, sorry.

My project has Twitter, Discord, Google social sign-ins. I have an account that has Twitter and Google linked, but not Discord. Unless all three are linked, there is no way to unlink any of the two social sign-ins. If I link all three then I can choose one to disconnect, but then after that the behaviour reverts to above.

So if you only have e.g. Google linked to your account, you cant unlink it?

Can I reproduce this with two social sign-ins?
Have to check which would be easy to set up as I dont have a dev account for google/twitter ready.

Yes (you can reproduce this with two sign-ins)

But isn't that intended behaviour for two social sign-ins to prevent being locked out?