Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

When adding a phone number (or any other verifiable address) to an identity, is it intended, even though the verifiable address is in `pending` status and has not yet been confirmed, that no other identity can add the verifiable address?

This would make sense if there was some kind of timeout or expiration on verifiable addresses remaining in a `pending` state. But I don't see this to be the case. It appears that all Kratos does is check for the _existence_ of the verifiable address; not whether it has been successfully verified. I feel this should can be adjusted in a meaningful way. A verifiable address may be added any number of times to any number of accounts. However, it can only be verified on _one_ account. Once this happens, all other accounts are locked out of being able to verify the account until the _verified_ verifiable address is removed from its owning account.

Am I missing something simple?