Google’s OAuth Oops: Startup Domain Buybacks Exposing User Data!
Google’s OAuth login flaw can let someone buy a failed startup’s domain and use it to recreate old employee email accounts, gaining access to sensitive data from various applications like Slack and even HR systems. This oversight leaves millions at risk, despite Google’s initial claim of “intended behavior.”
Hot Take:
Who knew that your old startup’s domain could become the ghost of privacy past? Apparently, Google’s “Sign in with Google” feature is on a nostalgia trip, letting anyone with a failed startup’s domain revisit the good old days of accessing sensitive SaaS accounts. Who needs a time machine when you can just buy a domain?
Key Points:
- Google’s OAuth login flaw allows domain ownership to grant access to old employee accounts.
- Buying a defunct startup’s domain can expose sensitive data from multiple SaaS products.
- Google claims it’s intended behavior but re-opened the bug report after further scrutiny.
- Truffle Security found Google’s unique user identifier unreliable for preventing this flaw.
- Currently, no available protections for downstream software providers against this vulnerability.
Already a member? Log in here