Cybersecurity researchers from the firm Hunters discovered a vulnerability in Google Workspace that could allow unwanted access to Workspace APIs.

According to the Hunters team, the vulnerability is based on Google Workspace’s role in managing user identities across Google Cloud services.

Domain-wide delegation connects identity objects from either Google Workspace Marketplace or a Google Cloud Platform Service Account to Workspace.

Once inside an account with Super Admin privileges, attackers could potentially view emails in Gmail, view someone’s schedule in Google Calendar or exfiltrate data from Google Drive.

The end result is a JWT object, which can be exchanged with a temporary access token to allow access to Google APIs.

Figure A. The tool is intended for researchers in order to detect misconfigurations, and “Increase awareness around OAuth delegation attacks in GCP and Google Workspace and to improve the security posture of organizations that use the Domain-Wide-Delegation feature,” Hunters wrote.