A Dropbox breach has exposed a serious authentication weakness after attackers gained unauthorized access to user accounts through a third-party single sign-on option. The cloud storage company has begun emailing affected customers to explain what happened and outline the steps it has taken to secure their accounts.
According to notifications sent to users, Dropbox observed unauthorized access to accounts between August 4 and August 21, 2026. The company stated that its logs showed no evidence that files were viewed or downloaded, but it moved to alert users about the incident and recommend additional protective measures.
How the Lenovo SSO Flaw Worked
Dropbox partners with Lenovo as an identity provider, allowing users to log in with verified Lenovo IDs. The problem, according to Dropbox, stemmed from a weakness in Lenovo’s email verification process. That gap allowed an unauthorized party to register a Lenovo ID using a victim’s email address, even if the victim had never created a Lenovo account, and then use that credential to reach the associated Dropbox account.
The attack chain reportedly followed a predictable path. Attackers first compiled target email addresses, which are widely available through data breaches, public listings, and customer records. They then registered a rogue Lenovo ID tied to a victim’s email without needing inbox access, because the verification step was missing or could be bypassed. One user who reclaimed a fraudulent account found the display name set to “John Madden,” a sign of bulk, low-effort registrations.
The Deeper Authentication Failure
While Dropbox pointed to Lenovo’s verification process, the more significant issue appears to lie with Dropbox’s own single sign-on handling. When an attacker clicked “Continue with Lenovo,” Lenovo’s authorization server issued a token whose email claim matched the victim’s Dropbox account. Dropbox then resolved that email to the existing account and created a session automatically.
Critically, there was no password prompt, no step-up verification, and no consent request asking whether to link the new identity. From Dropbox’s perspective, a trusted identity provider had already vouched for the address, so the session was granted. Requiring users to confirm the linked ID with their existing login would have blocked the attack entirely, making the missing check a serious oversight.
Dropbox has since fixed the flaw and expired all sessions that had been authenticated through a Lenovo ID.
Source
Image: 9to5mac.com
