Google fixes a flaw after hackers bypassed email verification to create “a few thousand” Workspace accounts to access 3rd-party apps via Sign in with Google
Brian Krebs / Krebs on Security : X: @_prbh . LinkedIn: Brian Krebs . Forums: Hacker News and Slashdot X: @_prbh : Authentication bypass by merely changing the email address during the token verification step. Quite similar to the Apple iCloud bug from sometime back. https://krebsonsecurity.com/ ... LinkedIn: Brian Krebs : Google says it recently fixed an authentication weakness that allowed crooks to circumvent email verification needed to create a Google Workspace account … Forums: Hacker News : Crooks Bypassed Google's Email Verification to Create Workspace Accounts, Acces BeauHD / Slashdot : Crooks Bypassed Google's Email Verification To Create Workspace Accounts, Access 3rd-Party Services
Context & Ripple Effects
This is the latest security issue involving Google’s identity and messaging infrastructure: Google previously fixed a Gmail and G Suite flaw that enabled SPF and DMARC spoofing, while researchers later reported abuse of an OAuth endpoint to restore expired authentication cookies after password resets.
The distinction matters because this incident targeted account creation and the trust carried by Sign in with Google, rather than stealing an existing user’s credentials. Earlier Google research documented credential theft at scale, underscoring why identity-provider controls are a high-value target.
First-order effects
- Google has closed the email-verification bypass, cutting off the reported route for creating fraudulent Workspace identities and using them to reach third-party apps through Sign in with Google.
- Third-party services that accepted those Google identities could have received accounts whose email ownership was not genuinely verified, even though the identity assertion came from Google.
Second-order effects
- Relying-party apps may need to treat a Google sign-in as one signal in onboarding and fraud controls, particularly for newly created Workspace identities, rather than as sufficient proof of a user’s legitimacy.
- Google’s fix shifts attackers toward other account-lifecycle weaknesses; the prior reported OAuth cookie-restoration abuse shows that password resets and token handling remain consequential identity-control layers.
Third-order effects
- If similar flaws recur, federated identity providers and the apps that rely on them will face pressure to make assurance levels more explicit across account creation, verification, and token recovery—not simply at login.
- The broader security burden is moving from password defense alone to securing the full identity lifecycle, including how a newly issued account can be used across connected services.
The trend: Federated sign-in is increasingly a security boundary whose reliability depends on every upstream account-verification and session-recovery step.