Dropbox Lenovo ID Integration Flaw Exposes Thousands of Accounts Without Passwords

A flaw in the federated authentication process between Dropbox and Lenovo ID allowed attackers to compromise approximately 5,000 accounts between August 4 and August 21, 2026. Attackers registered a Lenovo ID using the email address tied to an existing Dropbox account due to missing email verification checks. They then logged in via the Lenovo ID option, and Dropbox automatically associated the identity with the existing account without requiring the original Dropbox password. Only accounts linked to the Lenovo ID integration and lacking two-factor authentication were affected. In fewer than one-third of the compromised accounts, attackers viewed or downloaded stored files. Dropbox responded by terminating all Lenovo ID sessions, removing existing associations, and updating the login flow to require the Dropbox password. Lenovo described the issue as stemming from a legacy integration and stated that its own customers were not directly impacted.

BoletimSecSeptember 3, 2026Translated from Portuguese

Read at source

A flaw in the integration between Dropbox and Lenovo ID allowed attackers to compromise around 5,000 accounts between August 4 and August 21, 2026, without needing the victims' original passwords.

The vulnerability resided in the federated authentication process. Attackers could register a Lenovo ID using an email address already linked to a Dropbox account because the system failed to properly verify ownership of that address. Once registered, they simply selected the Lenovo ID login option on Dropbox. Because Dropbox trusted the identity asserted by the external service, the email was automatically bound to the existing account, creating an authenticated session without any password prompt.

Only accounts that had previously enabled the Lenovo ID integration and did not have two-factor authentication turned on were exposed. In less than one-third of the affected cases, attackers viewed or downloaded files stored in the compromised accounts.

Lenovo characterized the problem as related to a legacy integration that could incorrectly authenticate certain Dropbox accounts. The company confirmed that its own customers were not directly affected and said it continues to investigate the incident.

After detecting the activity, Dropbox immediately terminated all active sessions authenticated through Lenovo ID, removed the existing associations between the two platforms, and modified the login flow to require the Dropbox password before granting access. The company advised affected users to change their Dropbox and associated email passwords, enable two-factor verification, and review active sessions, connected applications, shared links, and recent file activity.

Dropbox Lenovo ID Lenovo

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Data Breaches & Leaks

Data Breaches & Leaks

Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks

Yandex has recovered access to 96 percent of user data stored on Yandex Disk following attacks that damaged its data centers. Files including documents, photographs, and videos are once again available for opening, downloading, and sharing for the majority of users. The company continues to redistribute Disk capacity across independent external sites to improve overall resilience. Basic operations such as uploading, downloading, and synchronization are now functional, yet the web version still imposes restrictions on bulk actions like downloading entire folders or multiple files at once. Users are advised to rely on the desktop client or API for these tasks during the remaining recovery phase. Yandex publishes ongoing updates on the official Yandex 360 service status page and has not provided an exact date for full restoration.

AntiMalwareOct 28, 2026Translated from Russian

Data Breaches & Leaks

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.

BoletimSecOct 26, 2026Translated from Portuguese

Data Breaches & Leaks

OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach

OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.

BoletimSecOct 20, 2026Translated from Portuguese