Automatic Authentication Security

The purpose of the “send a link”, “click a link” is not to secure your site. It’s only to prove that the individual registering has access to the email address they provided - frequently only needed for a password reset process, and to deter someone from trying to set up an account for someone else’s email address.

This can be addressed in a different way. Upon registration, the account is marked “unverified”. You send a verification email. Clicking on that link changes your status from unverified to verified. You then only ever send emails to verified accounts.

So the bottom line is, no. If you don’t absolutely need to verify that the email address supplied is valid, there is no implicit security threat created by an immediate login process.