GoKawiilMultiple Dropbox users have been emailed by the cloud storage company to advise them that a security breach saw unauthorised access to their account.
The root cause appears to be a lack of authentication by Dropbox when attackers created a single sign-on option through a third-party company …
Developer Yoni Levy posted a copy of the email he received on X.
We are writing to let you know that we’ve observed unauthorized access to your Dropbox account between August 4 and August 21, 2026. While our logs show no evidence that your files were viewed or downloaded, we want to share with you what happened, what we are doing about it, and what additional steps you can take.
Other Dropbox users reported receiving the same email in which the company said it resulted from a problem with a single sign-on (SSO) option using Lenovo IDs.
Dropbox partners with Lenovo as an identity provider so that users can log in to their Dropbox accounts using verified Lenovo IDs. While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.
However, while Dropbox claims the flaw was in Lenovo’s email verification process, the bigger issue appears to be that Dropbox itself did not require users to use their existing login to verify the new SSO, as The CyberSec Guru reports.
Recon/selection: The attacker compiles target email addresses (breach corpora, LinkedIn, customer lists — email addresses are effectively public data). Rogue IdP enrollment: The attacker registers a Lenovo ID as [email protected] . No inbox access is needed because Lenovo’s verification step is missing or bypassable. The display name is set to something disposable — one victim who reclaimed the rogue account found the name “John Madden,” the late NFL broadcaster, a strong tell of bulk, low-effort registration. Federated sign-in: The attacker clicks “Continue with Lenovo” on Dropbox. Lenovo’s authorization server issues a token whose email claim matches the victim’s Dropbox account. Implicit account linking: Dropbox resolves the email claim to the existing account and mints a session. No password prompt, no step-up, no “link this new identity?” consent. From Dropbox’s perspective, a trusted IdP had already vouched for the address.
9to5Mac’s Take
While there was certainly a failure to verify email addresses at the Lenovo end, it would not have done any harm if Dropbox had authenticated the linked ID before it could be used to sign in. Failing to do so is an egregious fault.
... continue reading