for signup with confirmation method, users with unconfirmed emails can signup again with the same emails but different passwords

but in db, it's actually still the same password when the users first signed up.

now after users confirm their emails this time, they won't be able to log in because they think the passwords are what they just submitted instead of the one during their first signups. this could be very confusing to users. i'm wondering if anyone has some feasible solutions?

ofc, what's really needed is the auth table can actually update the password whenever users use the same email (but unconfirmed) to signup again.