Overview
A critical vulnerability in Google's OAuth authentication flow enables attackers to exploit domain ownership changes for unauthorized access. The flaw affects millions of users through Sign in with Google
Whom it may concern
- IT Security Teams managing OAuth implementations
- SaaS Platform Administrators
- Startup companies using Google authentication
- HR departments with sensitive data exposure risk
Key Findings
- Attackers can acquire expired domains to access multiple SaaS applications
- Google has acknowledged the issue with a $1,337 bounty
- Sensitive HR data exposed including SSNs and tax documents
- Sub field provides potential mitigation but implementation varies
Risk Analysis
- Probability: High due to ease of domain acquisition
- Impact: Critical - affects multiple systems and sensitive data
- Attack Vector: OAuth token manipulation
- Exposure: Millions of users potentially affected
Action Items
- Implement sub field as unique identifier
- Proper domain decommissioning procedures
- Regular audit of third-party application access
- Update authentication implementations per Google's guidance
Sources
- [The Hacker News](https://thehackernews.com/2025/01/google-oauth-vulnerability-exposes.html)
