# Login with Google Not Authenticated on iOS App

Instacart's google_login_auth API accepted Google id_tokens issued to any OAuth client, letting another app's token log into arbitrary Instacart accounts.

- Payout: hidden
- Severity: low
- Program: Instacart
- Found by: bhavukjain1
- Disclosed: 2017-05-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/202177
- Library page: https://bugbountylibrary.com/r/h1%3A202177
- Tags: area:mobile domain:api domain:mobile impact:ato kind:bounty platform:hackerone sev:low tech:ios tech:oauth vuln:account-takeover vuln:auth-bypass

**Target:** iOS app Google login backend endpoint /api/v2/users/google_login_auth
**Root cause:** Backend verifies the Google id_token signature but not its audience (client_id), so tokens minted for any other Google OAuth app are accepted.
**Steps:**
1. Obtain a Google id_token issued to a different app (e.g. Meetup) via Login with Google.
2. POST to `https://www.instacart.com/api/v2/users/google_login_auth` with parameters `access_token`, `client_id`, `id_token`, `login_only`, `read_terms`, supplying the foreign id_token.
3. Observe the endpoint accepts the token and authenticates the corresponding user.
**How found:** Noticed the login flow passes a Google id_token to the backend and tested whether the backend checks which client the token was issued for by replaying a Meetup-issued id_token.
**Exploitation:** Attacker with control of another Google-integrated app obtains id_tokens for victim Google accounts from their own client and replays them to Instacart's google_login_auth to take over those accounts.
**Insight:** For social-login endpoints, replay an id_token minted for a different OAuth client you control; if the backend skips audience/client_id validation, it authenticates the wrong app's users.