Sign in with Plex fails if you are already signed in to ThinkAuth

What happens

If you already have an active ThinkAuth session and then use Sign in with Plex, the sign-in fails. Plex itself reports success, but you are returned to the login screen or shown "Request has been denied".

Signing in with Plex from a signed-out state works normally.

Workaround

Sign out of ThinkAuth completely, then start again from ThinkFeedback.

Why it is Upstream

The defect is in Authentik, not in a Think service. SourceFlowManager.get_action() forwards its arguments to two of its three update_user_connection() calls but not the third — the one taken when the request is already authenticated and a source connection already exists. The stored Plex token is nulled and the flow fails.

Reported upstream as goauthentik/authentik#25115. This post tracks that fix.

A database-level mitigation is already applied so the failure is a clean denial rather than a server error.