Ory allows users to link their social sign-in accounts to their existing accounts automatically using a secure flow. Here's how it works: 1. The user creates an account with an identifier (like an email) and a password. 2. When signing in later, the user chooses to sign in with a social sign-in provider. That social sign-in account contains the same identifier. 3. Since the identifier is already registered, the user cannot be logged in directly. Instead, the user will be prompted to enter the password chosen in step 1. 4. After entering the correct password, the social sign-in is linked to the user's account. Now they can sign in with either password or social sign-in provider. However, it's important to note that automatic account linking can be a security risk. To prevent unauthorized account linking, users need to verify an additional credential before the accounts can be linked. In the scenario where a malicious actor tries to link to an existing account, they would be prompted to enter the password associated with the identifier. Here's the [source](
https://www.ory.sh/docs/kratos/social-signin/link-multiple-provider-account#automatic-account-linking) for more details.