A flaw in Google OAuth system is exposing millions of users via abandoned accounts

Just because a business shuts down, it doesn't mean all its data is gone

News By Sead Fadilpašić published 15 January 2025

Image Credit: Shutterstock (Image credit: Shutterstock)

• Buying domains from businesses that shut down could grant access to their SaaS accounts, research finds
• Google argues it's not a vulnerability, and that businesses should make sure they're not leaving sensitive information behind
• Researchers propose additional safeguards

Experts have found a vulnerability in Google’s OAuth “Sign in with Google” feature which could allow malicious actors to access sensitive data belonging to businesses that have shut down.

Google acknowledged the flaw, but is not doing much to address it, rather saying that it is up to the businesses to ensure the security of the data they are leaving behind.

The vulnerability was first discovered by security researchers from Trufflesecurity, who reported it to Google in late September 2024. However, it was only after the company’s CEO and co-founder, Dylan Ayrey, presented the issue at Shmoocon in December 2024 that Google reacted.

Google suggests mitigations

Here is how it works, in theory:

A business signs up for an HR service using its business email account and the “Sign in with Google” feature. It uses the HR service for things like employee contracts, payouts, and more. Some time later, the business shuts down, and terminates the domain. After that, a malicious actor registers the same domain, and recreates the same email address used to log into the HR service.

They then proceed to log into the account on the HR platform, where they can access all the information and files left behind.

Google awarded Trufflesecurity a small bounty, but decided not to pursue a fix: "We appreciate Dylan Ayrey’s help identifying the risks stemming from customers forgetting to delete third-party SaaS services as part of turning down their operation," a Google representative told BleepingComputer.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors