Is the lack of mail confirmation a vulnerability?

Question

Information Security

It seems that I understand myself that the vulnerability, since the mail entered by the user during registration is not reliable until he confirms it. But on the other hand, how serious are the consequences? what are the attack vectors? they just nag someone else's mail and the real owner will not be able to register? or could it be worse?

Answer 1

It all depends on the application and its curvature.
There is no vulnerability in non-confirmation of mail. You are right about spam registrations. But this is more or less solved by captcha.
I saw many services that do not immediately ask you to confirm your mail. Prominent examples are reg ru (domain registrar) and dudos guard (ddos protector)