Google’s OAuth Oops: How Defunct Domains Turn Hackers Into Unwanted Guests
A Google OAuth vulnerability lets attackers exploit domains from defunct startups to access sensitive SaaS-linked data. Despite awareness, the issue remains. Google advises closing out domains to mitigate risk. With millions of accounts at stake, affected users should act swiftly to safeguard their data.
Hot Take:
Looks like Google’s OAuth has a secret love affair with defunct startups’ domains! Who knew that the ghost of startups past could still haunt our data? Time to double-check where our login breadcrumbs lead!
Key Points:
- Trufflesecurity discovered a security flaw in Google’s OAuth “Sign in with Google” feature.
- Attackers can exploit defunct startup domains to access former employee accounts on SaaS platforms.
- Google initially dismissed the issue but later awarded a $1337 bounty and reopened the case.
- The flaw remains unfixed, potentially impacting millions of accounts.
- Proposed solutions include using immutable identifiers and cross-referencing domain registration dates.
Already a member? Log in here