We currently use Auth0 to manage our authentication. We have discovered a vulnerability where an attacker can get access to someone’s account by using the “Log In with Google”. We figure Auth0 must have seen this issue several times before, and may have suggestions on the best ways to fix it. Steps…

Hi @jusliu It sounds like you are using account linking to link the username/password account with the Google social account. Don’t do that! When linking two accounts, you should require proof that the user has access to both. John

Account Takeover using "Log In with Google"

Get Help

system Closed September 5, 2020, 9:51am 7

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Connecting email/password credentials and Google account Get Help email , google-signup , account	2	5899	March 2, 2018
Link Accounts with Same Email Address, Problem case Get Help auth0 , rules , login , linking-account	4	4750	August 22, 2019
Gmail and Auth account generate 2 different accounts Get Help account-linking	2	4918	March 2, 2018
Google signin in Auth0 specifying user email and google access token Get Help authentication-api , auth0 , api , passwordless , login	5	4806	April 9, 2021
Social Login First but wants to add password login Get Help auth0 , login	4	1802	August 8, 2022

Account Takeover using "Log In with Google"

Related topics