Google OAuth secrets exposed as account-hijacking MultiLogin vulnerability discovered

A malware developer was recently able to discover one of Google's OAuth secrets, a previously unknown feature named "MultiLogin" that is responsible for synchronizing Google accounts across different services. MultiLogin accepts a vector of account ID and auth-login tokens, using such data for managing simultaneous sessions or seamlessly switching between...

Read Entire Article

data developer feature google google accounts login malware oauth services tokens vector vulnerability