High · published November 25, 2025
🚨 A simple flaw in Google OAuth could hand over the keys to your account! The Lunary AI version 1.9.34 lacks proper validation, making unauthorized logins a breeze for attackers. 🔥 Think of it like a hotel that lets anyone with a reservation slip check in, regardless of whether they actually booked a room — only a diligent front desk clerk could prevent this mix-up! If exploited, an attacker could waltz right into users’ accounts, accessing sensitive data and potentially wreaking havoc. This vulnerability could lead to identity theft, unauthorized transactions, or leaking user information — absolutely devastating!
Think of it like a hotel that lets anyone with a reservation slip check in, regardless of whether they actually booked a room — only a diligent front desk clerk could prevent this mix-up! The vulnerability arises from improper authentication within the Google OAuth integration, where the application fails to verify the 'aud' (audience) field in the access token issued by Google. This allows attackers to use tokens meant for other applications to gain unauthorized access to user accounts.
If exploited, an attacker could waltz right into users’ accounts, accessing sensitive data and potentially wreaking havoc. This vulnerability could lead to identity theft, unauthorized transactions, or leaking user information — absolutely devastating! To protect yourself, upgrade to Lunary AI version 1.9.35 immediately. Additionally, review your authentication procedures to ensure proper validation of all incoming tokens. You've got this! By following these steps, you'll help safeguard user accounts and enhance your security posture. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| lunary/lunary | all versions | — |