According to Google, a "specially constructed request" could open a Workspace account without verifying the email, allowing bad actors to impersonate targets easily.
Thousands of compromised unverified Workspace accounts were detected, utilized to access third-party services like Dropbox via 'Sign in with Google' feature, posing potential data security risks.
Collection
[
|
...
]