By default, Google ID tokens are scoped to the specific OAuth client ID that requested them. Because bbs-go neglects to validate that the 'aud' claim matches its own registered client ID, an attacker can create their own Google OAuth client and obtain an ID token. An attacker can then replay a victim's Google ID token - or use a token issued to the attacker's own client - to successfully authenticate as the victim's Google-linked account. This flaw allows for full account takeover of any user associated with a Google identity, posing a significant risk to user confidentiality and account integrity.

Impact

Successful exploitation of this vulnerability results in unauthorized access to user accounts. An attacker can impersonate any user who has linked a Google account to their bbs-go profile, gaining full access to the victim's data and account privileges. This vulnerability impacts all installations of bbs-go version 4.4.6 and earlier.

Recommendation

1. Upgrade bbs-go to a patched version once available that implements strict validation of the 'aud' claim in Google ID tokens.
2. Implement monitoring on web access logs for the /api/login/google_one_tap endpoint to identify anomalies in successful login rates or unexpected 'aud' claims if logging allows inspection of the token payload.
3. Review audit logs for suspicious account modifications or unauthorized access patterns if the application logs identity provider information.