diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
index f26542e88..705035845 100644
--- a/lib/pleroma/web/endpoint.ex
+++ b/lib/pleroma/web/endpoint.ex
@@ -169,6 +169,8 @@ def call(conn, opts) do
 
   plug(MetricsExporterCaller)
 
+  plug(Pleroma.Web.Plugs.ConfirmUserPlug)
+
   plug(Pleroma.Web.Router)
 
   @doc """
diff --git a/lib/pleroma/web/plugs/confirm_user_plug.ex b/lib/pleroma/web/plugs/confirm_user_plug.ex
new file mode 100644
index 000000000..218068de0
--- /dev/null
+++ b/lib/pleroma/web/plugs/confirm_user_plug.ex
@@ -0,0 +1,30 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Plugs.ConfirmUserPlug do
+  @moduledoc """
+  If a user has ever been granted an OAuth token, they are eligible to become
+  confirmed, regardless of the account_activation_required setting. This plug
+  will confirm a user if found.
+  """
+
+  alias Pleroma.User
+  import Plug.Conn
+
+  def init(opts), do: opts
+
+  def call(%{assigns: %{user: %User{confirmation_pending: true} = user}} = conn, _opts) do
+    with {:ok, user} <- confirm_user(user) do
+      assign(conn, :user, user)
+    end
+  end
+
+  def call(conn, _opts), do: conn
+
+  defp confirm_user(%User{} = user) do
+    user
+    |> User.confirmation_changeset(need_confirmation: false)
+    |> User.update_and_set_cache()
+  end
+end
diff --git a/test/pleroma/web/plugs/confirm_user_plug_test.exs b/test/pleroma/web/plugs/confirm_user_plug_test.exs
new file mode 100644
index 000000000..43c1c28a9
--- /dev/null
+++ b/test/pleroma/web/plugs/confirm_user_plug_test.exs
@@ -0,0 +1,30 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Plugs.ConfirmUserPlugTest do
+  use Pleroma.Web.ConnCase, async: true
+  alias Pleroma.User
+  alias Pleroma.Web.Plugs.ConfirmUserPlug
+  import Pleroma.Factory
+
+  test "it confirms an unconfirmed user", %{conn: conn} do
+    %User{id: user_id} = user = insert(:user, confirmation_pending: true)
+
+    conn =
+      conn
+      |> assign(:user, user)
+      |> ConfirmUserPlug.call(%{})
+
+    assert %Plug.Conn{assigns: %{user: %User{id: ^user_id, confirmation_pending: false}}} = conn
+    assert %User{confirmation_pending: false} = User.get_by_id(user_id)
+  end
+
+  test "it does nothing without an unconfirmed user", %{conn: conn} do
+    assert conn == ConfirmUserPlug.call(conn, %{})
+
+    user = insert(:user, confirmation_pending: false)
+    conn = assign(conn, :user, user)
+    assert conn == ConfirmUserPlug.call(conn, %{})
+  end
+end