Dropbox users affected by security breach due to SSO authentication flaw

Unauthorized Access to Dropbox Accounts

Dropbox has informed multiple users about unauthorized access to their accounts that took place between August 4 and August 21, 2026. While Dropbox logs indicate no files were viewed or downloaded, the company is notifying affected users about the incident and steps they can take.

Root Cause: Single Sign-On Vulnerability

The breach originated from a vulnerability in Dropbox's single sign-on (SSO) integration with Lenovo IDs. Dropbox partners with Lenovo as an identity provider, allowing users to log in using verified Lenovo IDs. The core issue was identified as a flaw in Lenovo's email verification process, which permitted an unauthorized party to register a Lenovo ID using a victim's email address without requiring inbox access.

Dropbox's Authentication Failure

While Dropbox attributed the flaw to Lenovo's verification, a critical contributing factor was Dropbox's own authentication procedure. Dropbox did not require users to verify the new SSO link with their existing login credentials. This allowed the system to implicitly link the newly created, unverified Lenovo ID to an existing Dropbox account based solely on the email address, bypassing password prompts or consent for linking a new identity.

Attack Vector Details

The attack involved several steps: attackers compiled target email addresses, registered rogue Lenovo IDs using these emails by exploiting the missing verification, and then used the 'Continue with Lenovo' option on Dropbox. Lenovo's authorization server issued a token, and Dropbox resolved the email claim to an existing account, creating a session without further authentication.

Impact and Takeaways

This incident underscores the security risks associated with federated identity management when proper verification and linking protocols are not rigorously enforced by all parties. It highlights the importance of multi-factor authentication and explicit user consent when linking new identity providers to existing accounts, even when relying on trusted third-party services.