Google OAuth flaw lets attackers gain access to abandoned accounts

**Executive summary:** A flaw in Google’s OAuth "Sign in with Google" can allow attackers who register defunct startup domains to recreate former employee email accounts and access linked SaaS services (Slack, Notion, Zoom, HR systems), potentially exposing sensitive data; TruffleSecurity demonstrated the issue, Google awarded a bounty but the vulnerability remains unresolved.