Stop Trusting the OAuth Email: How One Missing Check Enables Account Takeover in 2026

Initial Notes

This type of article is, as far as I know, one of the first of its kind. I couldn’t find any article that goes deeply into the technical side of this type of vulnerability.

There have been some vulnerabilities discovered around the same topic in 2026, according to the CVEs I found, which I’ll mention later in the article.

I hope you enjoy reading it! This article is the result of a lot of research, experimentation, and countless attempts , and “hopefully”, none of them were illegal 😅.

How the Idea Came

On October 1st, 2026, I had a rather difficult day. When I got home, I registered for a website using Google OAuth 2.0, which was also offered on the signup page as:

e.g

Once I had registered with Google, I realized something interesting about this website.

At one point, when I had tried to...

Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE