I Found a High-Severity OAuth Account Takeover Vulnerability on IIT Madras’s Student Portal

A broken OAuth flow on IITM’s student portals let any student take over another’s account using just their own email. No tools. No tricks.

Severity: HIGH | Category: Broken Access Control / Authorization Bypass | Status: Fixed | Platform: IIT Madras IITM BS Program Portals (study.iitm.ac.in)

Background

IIT Madras’s online BS degree program is one of the largest distance-learning initiatives in India, serving tens of thousands of students across two independent streams: Data Science and Applications and Electronic Systems. Both programs run on separate sub-portals under a shared domain and rely on Google OAuth for student authentication.

During a security assessment of publicly accessible educational platforms, I came across a significant flaw in how the IITM BS portals handle authentication across their two sub-portals. What I found was not a misconfiguration or a minor data exposure; it was a complete account takeover triggered by nothing more than a standard, legitimate OAuth login using a valid student email address.

I chose to report it responsibly. This post documents everything from discovery to fix.

The Vulnerability

Root Cause

Each IITM BS portal maintains its own student database and maps an incoming OAuth login to a local account using the student’s Roll ID, derived from their institutional email. The system does not verify that the email being used for OAuth actually belongs to a registered account on the destination portal. It simply extracts the Roll ID, looks it up in the portal’s student database, and grants access to whichever account matches.

Here is the problem: students across the Electronic Systems and Data Science programs can hold numerically identical Roll IDs in their respective programs. So when an ES student completes an OAuth flow on the DS portal using their own email, the system extracts their Roll ID, finds a DS student with the same Roll ID number, and grants full access to that student’s account.

The email address is used only to complete the OAuth handshake with Google. After that, it plays no role in account resolution. The destination portal trusts the Roll ID match alone, with no verification that the authenticated email corresponds to an actual registered user on that portal.

Why This Is Serious

This is a textbook case of Broken Access Control (OWASP A01:2021) combined with an improper OAuth identity binding.

• The attacker uses their own legitimate credentials throughout. No phishing, no session theft, no crafted payloads.
• The victim receives no notification and sees no anomaly on their end.
• The attacker gains full read and edit access to the victim’s name, phone number, email address, home address, academic progress, badges, and all profile sections.
• Any ES student whose Roll ID numerically matches a DS student’s Roll ID (or vice versa) can trigger this. The attack surface scales with the number of such overlapping Roll IDs across both programs.

Vulnerability Summary

Category: Broken Access Control, OAuth Identity Binding Failure 
Severity: High 
Authentication: Required Yes (valid IITM student login, own credentials) Tools Required None 
Complexity: Low; triggered by a normal OAuth login flow 
Data Exposed: Name, phone, email, address, academic profile, badges Status Patched by IITM Technical Team

Steps to Reproduce

No tools, proxies, or technical setup required.

Step 1: Navigate to the Electronic Systems portal and log in using a valid IITM student email via Google OAuth. Confirm the account is authenticated correctly on the ES portal.

Step 2: Log out completely from the Electronic Systems portal.

Step 3: Navigate to the Data Science portal and initiate a fresh OAuth login using the exact same email address.

Result: Instead of being denied access (since the email belongs to an ES student, not a DS student) or being shown an error, the system extracts the Roll ID from the email, finds a DS student in the database with the same Roll ID number, and logs you directly into that student’s account. Full, unauthorized read and edit access to their profile is granted immediately.

The critical point here is that this is a completely fresh OAuth flow using the attacker’s own credentials. There is no session hijacking, no session reuse, and no token manipulation. The vulnerability lies entirely in how the destination portal resolves identity after a legitimate OAuth login.

Affected Components

• Google OAuth identity resolution logic on IITM BS sub-portals
• Cross-portal account lookup mechanism (Roll ID based, without email ownership verification)
• Student dashboard and profile modules on both portals

Proof of Concept (Screenshots)

All screenshots were submitted to the IIT Madras Technical Team as part of the responsible disclosure. Personally identifiable information of the affected student has been blurred.

Screenshot 1:

Step 1: Legitimate OAuth login on the Electronic Systems portal. The account shown correctly belongs to the student who initiated the login. Programme: BS in Electronic Systems, Level: Degree.

Screenshot 2:

Step 3: Fresh OAuth login on the Data Science portal, same email. The system resolved the Roll ID to a different DS student’s account entirely. The name in the top-right corner is not the person who logged in. Full read and edit access to the victim’s profile, contact details, and academic data was immediately available. PII blurred.

Responsible Disclosure Timeline

17 Jun 2026: Initial disclosure email sent to IITM support with a vulnerability summary and an offer to share the full PoC securely.

19 Jun 2026: Support team raised ticket #433549 and escalated internally to the IITM BS Technical Team.

21 Jun 2026: The Technical Team responded, requesting complete reproduction steps and supporting evidence.

22 Jun 2026: Full technical report submitted.

24 Jun 2026 IITM confirmed the vulnerability had been resolved.

25 Jun 2026 IIT Madras issued a formal written acknowledgement.

Acknowledgement from IIT Madras

IIT Madras Technical Team, Jun 2026

Closing Thoughts

Finding a vulnerability on a platform used by tens of thousands of students carries a clear obligation: report it responsibly and make sure it gets fixed. The IIT Madras team responded professionally and addressed the issue promptly.

Keep learning. Stay ethical.

You can connect with me on LinkedIn and X.