@dan It is like that. They use regular /oauth2/register flow to create spam accounts. Even though we deploy WAF, it usually can't catch them as they obey the rate-limits. Screenshot 2025-09-15 at 6.09.30 PM.png

FYI, this was fixed in 1.60.0, per the release notes.

In version 1.59.0 the password is now optional when creating or updating a user.

When returning from a third-party login, a user may be prompted to complete registration by entering a password when self-service is enabled and is configured to require a password.

This was unintended and has been corrected.

https://fusionauth.io/docs/release-notes/

Tracking issue: https://github.com/FusionAuth/fusionauth-issues/issues/3159