Account Takeover

Dropbox breach Lenovo email verification flaw exposes thousands of accounts

Once the bogus Lenovo ID was created, Dropbox’s SSO flow trusted Lenovo’s assertion that the email belonged to the requester.