Google IdP Vulnerability Enables Universal Account Takeover via Device Code Flow Hijacking

The post describes a vulnerability in Google’s implementation of RFC 8628’s device authorization grant, which allows devices like TVs or CLIs to poll for login on a secondary screen. The flaw enabled the entire session to be transferred across browsers, as Google’s authorization server failed to verify that the client_id and scope in the consent URL matched those originally issued for the device_code. Additionally, using prompt=none reduced the attack to a one-click, invisible account takeover.