Dropbox breach reportedly allowed SSO logins without verifying existing account ownership

The breach stemmed from a breakdown in Dropbox’s handling of federated identity claims. Attackers registered Lenovo IDs using victim email addresses, leveraging a flaw in Lenovo’s verification process. Dropbox then accepted these unverified identities as valid SSO credentials, granting access to existing accounts without additional checks. This highlights a critical oversight: federated logins must not bypass primary account authentication, even when the identity provider is trusted.

The attack required no compromise of user credentials or inbox access. Email addresses, often public or leaked in prior breaches, were sufficient to exploit the SSO flow. Lenovo’s verification failure allowed bulk registration of identities, while Dropbox’s implicit linking of these identities to existing accounts removed the final barrier. The incident underscores the need for step-up authentication or explicit user consent when linking new identity providers to established accounts.

Dropbox’s response, expiring all sessions authenticated via Lenovo SSO, mitigates immediate risk but does not address the root issue. The fix assumes that all prior Lenovo-authenticated sessions were malicious, which may disrupt legitimate users. Engineers integrating SSO should enforce re-authentication for new identity providers and validate email ownership independently, rather than relying solely on the provider’s claims. This breach serves as a case study in the risks of over-trusting third-party identity systems.