Google OAuth secrets exposed as account-hijacking MultiLogin vulnerability discovered

A malware developer was recently able to discover one of Google's OAuth secrets, a previously unknown feature named "MultiLogin" that is responsible for synchronizing Google accounts across different services. MultiLogin accepts a vector of account ID and auth-login tokens, using such data for managing simultaneous sessions or seamlessly switching between...

Read Entire Article

account accounts auth data developer discover exposed feature google google accounts hijacking login malware malware developer oauth responsible secrets services sessions tokens vulnerability