# Account takeover via Google OneTap

Unverified GSuite domain claim let attacker register victim's email domain with Google, then OneTap sign-in to Priceline took over the account.

- Payout: hidden
- Severity: high
- Program: Priceline
- Found by: badca7
- Disclosed: 2022-05-11
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/671406
- Library page: https://bugbountylibrary.com/r/h1%3A671406
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained vuln:account-takeover vuln:auth-bypass

**Target:** Google OneTap / GoogleYOLO SSO login on www.priceline.com
**Root cause:** Backend trusts the email asserted by Google OneTap without verifying the email is confirmed/verified, so an attacker who registers the victim's email domain in an unverified GSuite trial can mint an identity for that email.
**Steps:**
1. Create Priceline account A via email registration (`badca7@wearehackerone.com`), add dummy phone number as canary.
2. In incognito, sign up for GSuite trial at gsuite.google.com/signup/basic/welcome as account B using any unconfirmed email.
3. In the wizard, claim the victim's email domain (e.g. `wearehackerone.com`) as the business domain; do not verify it.
4. Sign in/out of the new GSuite Google account and refresh priceline.com until the OneTap popup lists the new account.
5. Click the OneTap account to sign in to Priceline; observe the canary phone number confirming access to account A.
6. Account takeover complete; victim session shows profile data blanked.
**How found:** Noticed OneTap login trusted the email without confirmation; hypothesized that controlling the email domain via an unverified GSuite signup would let them assert any address on that domain, then tested with a canary phone number.
**Exploitation:** Attacker claims the victim's email domain in an unverified GSuite trial, then uses Google OneTap on priceline.com to authenticate as an email under that domain, gaining the victim's account without any password or email confirmation.
**Insight:** When a site accepts federated identity (OneTap/YOLO), check whether it validates email_verified and domain ownership; unverified GSuite/Workspace domain claims can mint identities for arbitrary addresses on a domain.