Tampering with scopes in Galoy/Blink OAuth consent gave any client admin privileges; September attack took over 35 accounts and withdrew funds from 24

The Galoy/Blink consent application accepted a scope list directly from a browser form without checking it against what the OAuth client had requested, allowing an ordinary registered user to obtain a token with a full set of administrative privileges. In affected deployments, the admin gateway and admin GraphQL API trusted these scopes without their own checks, allowing access to customer data (balances, history, contacts, login methods), email and phone changes, and account takeover through passwordless login. No compromise of signing keys was required: the identity provider itself issued the tokens, so signature verification does not detect the attack. According to the incident analysis, this method was used to take over 35 custodial accounts at Blink in September 2026 and withdraw about 6.61 BTC from 24 of them.