2 ms·
Security breach: For a target with a Gmail account, create an account on an unsecured OAuth provider, login to such sites with the unsecured email, access their
by eastbound 2y ago
Security breach: For a target with a Gmail account, create an account on an unsecured OAuth provider, login to such sites with the unsecured email, access their data because it allows auth with any OAuth provider.
- ascorbic 2y agoDo any sites allow login from any OAuth provider? How would that even work? Providers need client IDs and client secrets.
- dotancohen 2y agoThe intent was probably "multiple", not "any".
- portaouflop 2y agoEasily preventable. Ask the user to supply a credential before linking the accounts or only allow account linking if the email is verified at the idp (as someone else noted this is not possible for all idps but for google it is)