Zero Day Alert: Google OAuth Flaw Could Expose Abandoned Accounts

A critical flaw in Google’s OAuth “Sign in with Google” feature could enable attackers to exploit abandoned domains of defunct startups. This flaw allows unauthorized access to sensitive accounts linked to various Software-as-a-Service (SaaS) platforms. 🛠️🔑

1️⃣ Domain Exploitation: Attackers purchase domains of failed startups and recreate email accounts of former employees.

2️⃣ OAuth Weakness: Google’s OAuth doesn’t protect against this scenario, allowing attackers to:

3️⃣ Inconsistent Identifiers: Google’s sub claim (unique user identifier) has an inconsistency rate of ~0.04%. As a result, SaaS providers like Slack and Notion rely solely on email and domain claims, which attackers can inherit. 📧