[ethanblake4]

Author here, the exact same thing that I did is possible for any 3rd party SSO on mobile apps. It's not a Google exploit, it's an exploit in the idea of SSO.