Dropbox Breach Tied to Lenovo SSO Flaw, with Own Authentication Lapse Called Out

A copy of the email was posted on X by developer Yoni Levy, and other users reported receiving the same notice. Dropbox attributed the breach to Lenovo's email verification process, saying an unauthorized party registered a Lenovo ID using a customer's email address by exploiting that flaw, then used the ID to log into the associated Dropbox account. The email said, "An issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address."

However, security news site The CyberSec Guru reported that the larger problem is Dropbox itself, which did not require users to verify the new SSO with their existing login credentials before linking it to an account. The attack chain begins with the attacker compiling target email addresses from breach corpora or public sources, then registering a rogue Lenovo ID for the victim's address without needing inbox access, because Lenovo's verification step was missing or bypassable. The attacker then clicks "Continue with Lenovo" on Dropbox, and Lenovo's authorization server issues a token with the victim's email claim. Dropbox resolves that email to the existing Dropbox account and creates a session, with no password prompt, no step-up authentication, and no "link this new identity?" consent screen.

9to5Mac, which reported the breach, wrote in its analysis that while Lenovo certainly failed to verify email addresses, the intrusion would have been harmless if Dropbox had authenticated the linked ID before allowing it to be used for sign-in. "Failing to do so is an egregious fault," the report said. Dropbox has now fixed the flaw and expired all sessions previously authenticated through a Lenovo ID.