Crooks Bypassed Google's Email Verification to Create Workspace Accounts, Acces

So if you own example.com and use bigboss@example.com as log in to greatonlinegame.com ...

Someone can register example.com with google workspace and then they can use "login with google" to log in to your bigboss@example.com account at greatonlinegame.com, even though your account did not use "login with google".

Did i get it right?

And if i did, i wonder...

Why aren't these logins separate on greatonlinegame.com? If I did it i'd allow a login only by the method that was used to create the account, unless the user configures it otherwise.

Your understanding is correct. It happened to me; someone made a Workspace for a domain name I own, and made a user on that workspace to match an email address I have on that domain, and then used "Sign in with Google" on Dropbox. Luckily I don't use Dropbox, so instead of gaining access to my files there, it just resulted in a new Dropbox account being created.

I noticed all this, of course, because I got email notifications for all of it.

According to spec, when someone uses oauth to try and log into an existing account for the first time, you must require the user to login through their normal method and then prompt them to link the login account.

However, the identity provider cannot force you to do that, and there are many examples of apps which do not follow this part of the spec.

Curious, which part in RFC 6749 do you refer to or other ones?

I could have sworn I have seen this in the past, but I am not sure exactly where. Thinking about it; it probably would have been part of OIDC and not directly addressed by OAuth... maybe someone can find it for me, or maybe I misspoke when I said it was part of the spec.

I could believe that being in 2.1 as a BCP,but if it's not it's a good idea to add it.

Take superbase for example. If you allow multiple oauth providers accounts get automatically linked if they use the same email address. That’s bugging me since day one…

I've checked 2.0 Security BCP, 2.1 draft and OIDC and none of them seemed to cover that. Perhaps I could be in ongoing discussion in the mailing list of 2.1? I only checked their GitHub issues and found nothing relevant.