Threats tagged 'ghsa-h5hh-rp4r-9p9x'

mlogclub bbs-go versions up to 4.4.6 contain an authentication bypass vulnerability in the /api/login/google_one_tap endpoint. This flaw allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client without proper audience validation. Attackers can replay a victim's Google-signed ID token obtained from their own OAuth client to gain unauthorized access to the victim's Google-linked account.