[eastbound]

Security breach: For a target with a Gmail account, create an account on an unsecured OAuth provider, login to such sites with the unsecured email, access their data because it allows auth with any OAuth provider.

[portaouflop]

Easily preventable. Ask the user to supply a credential before linking the accounts or only allow account linking if the email is verified at the idp (as someone else noted this is not possible for all idps but for google it is)

[ascorbic]

Do any sites allow login from any OAuth provider? How would that even work? Providers need client IDs and client secrets.

[dotancohen]

The intent was probably "multiple", not "any".