Users Can Set YouTube Link to Google Logout URL

[Life_Blox]

Users can currently set their YouTube profile URL to YouTube’s logout URL https://youtube.com//logout which will log your browser out of every single google account currently signed in with no confirmation.

Example Profile

[13_5G (EpicPlayerPro_21)]

There are probably a dozen of link examples where stuff like this is possible. For example, you were able (I don’t know if it’s still possible) to set the link (Some random youtube link) which would download a (non malicious) file on your device. There are many of those random links people use for not intended purposes

[TimeFrenzied (Broken Spawn)]

bro why are you leaking my method

did you find this out from my profile

[13_5G (EpicPlayerPro_21)]

Nope this was a method for years actually… i knew this for a long time but never bothered reporting it as this is really just a small low prioriety bug that doesn’t do any actual harm

[TimeFrenzied (Broken Spawn)]

also this was already patched

i tried it a few days ago

it must not reset old people that did it

[bvetterdays (roman)]

Yes, this was already fixed. See this original report on your issue that has been closed as ‘Fixed’:

Certain "valid" social media links log you out of your account

If you edit your social links with a “logout” subdirectory, it will literally log you out of your account… If you’re signed in to multiple accounts, it will log you out of ALL them (if you’re logged into youtube). this applies to all types of social media links Reproduction: Update your Youtube social link to this url: Google Accounts Click on the link You should be logged out Expected behavior I should be able to access ANY link without inconveniences