# Google Exploit – Steal Account Login Email Addresses

Google Dashboard's uq parameter accepted any Google+ profile ID and leaked that account's login email via the AddSession redirect hash.

- Payout: $1,337
- Severity: medium
- Program: Google
- Credited: Tom Anthony
- Disclosed: 2014-03-08
- Write-up quality: 6/10
- Original: http://www.tomanthony.co.uk/blog/google-exploit-steal-login-email-addresses/
- Library page: https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-google-exploit-steal-login-email-addresses
- Tags: domain:web impact:pii-leak kind:bounty platform:blog sev:medium tech:oauth technique:recon vuln:access-control vuln:info-disclosure

**Target:** Google Dashboard /settings/dashboard endpoint and accounts.google.com AddSession
**Root cause:** The dashboard endpoint trusted a user-supplied Google+ profile ID (uq) and, for logged-in users, redirected to AddSession with the target account's login email embedded in the URL hash to pre-populate the login field, without authorization checks.
**Steps:**
1. Observe `https://www.google.com/settings/dashboard?uq=114756468015607312300` from a Google email; note uq matches public Google+ profile ID.
2. Replace uq with a victim's public Google+ ID: `https://www.google.com/settings/dashboard?uq=106858636547986185729`.
3. While logged into your own account, request the URL; receive 302 to `https://accounts.google.com/AddSession?continue=...#Email=REDACTED_EMAIL_ADDRESS`.
4. Read the victim's login email from the hash fragment.
**How found:** While exploring Google Dashboard, the author did a first pass of unauthorized requests and noticed one prompted the 'One account. All of Google' login screen pre-filled with an email for an account he wasn't authorized for; he then recognized the uq parameter as the public Google+ profile ID.
**Exploitation:** Attacker collects public Google+ profile IDs (present 400+ times in profile source), requests the dashboard URL with each ID while authenticated, and harvests login emails from the AddSession redirect hash; scalable via crawler to build a spear-phishing database.
**Insight:** Login/consent redirects that pre-populate fields via URL fragments can leak account identifiers; test whether ID parameters on authenticated endpoints reflect another user's data into redirect targets.