Product
The bbs-go application up to version 4.4.6 is vulnerable to an authentication bypass via the /api/login/google_one_tap endpoint due to missing validation of the Google ID token audience claim.