Security problem with PayPal Express Checkout auto login

Info

ZC 2.1 (also affects older versions I believe), PHP 8.4.13, 11.8.3-MariaDB-log
Modules: One page Checkout, MinimumOrderWholesale, POSM, saveforlater, sitemapXML, zonetable
Site URL: (dev site) https://new.bladescanada.ca/ - You can give PayPal the email "[email protected]" to log into a valid account.

Site files are fresh 2.1 but database has been upgraded several times over the years via zc_install/

The bug

If someone is:

1. Not signed in to our website.

2. Uses the "Check Out with PayPal" button.

3. In PayPal chooses to pay without signing in.

4. In PayPal enters any email address that matches an existing account on our website.

Then when they are brought back to our site they will be logged into that account without needing to enter a password. This is a huge security issue as anyone can log into any account so long as they know the email address, and then access previous orders and addresses.

They would have to pay for the order to get to this point, wouldn't they?

Technically no.

In my testing, when it returns to the site it goes back to the cart, not the order complete page. I think this is because it is merging the accounts saved cart with the not logged in one.

I should have explained better.

I'm trying to dup this, I get to the PayPal payment page, I enter the email [email protected], but unless I enter real credit card credentials, I can't get back to the cart, can I ?

yes you need to enter valid credit card data.

I can refund if it goes through, but my testing there with that email it goes back to cart.

Has this bug been confirmed? Is it being worked on?