Brevo SSO Flaw: 138 Accounts Accessed, Phishing Sent From Real Brands

On 10 September 2026, email marketing platform Brevo identified that an attacker had exploited a flaw in the way it handles SAML single sign-on. According to Brevo's incident write-up, the attacker reached 138 customer accounts, exported contacts from 43 of them and used 6 to send phishing emails to the contacts stored inside. One of those senders was hardware wallet maker Trezor, whose newsletter list of about 347,000 addresses received a fake security alert.

The phishing came from the brands' real accounts on legitimate infrastructure, so it passed standard email authentication checks.

What's affected

From Brevo's write-up (times in UTC):

• Detection: 06:30 on 10 September, Brevo identified the SSO issue.
• Containment: 08:30 the same day, Brevo closed the route and signed out every user on the platform. It reports no attacker activity since.
• Root cause: The attacker created a Brevo account, enabled SSO on it and invited legitimate Brevo users into that SSO configuration. Signing in as those invited users through the attacker's own identity provider was expected. The flaw was that the resulting access was not limited to the attacker's organization. It covered every organization those users could reach.
• Impact: 138 accounts accessed. 6 used to send phishing to their contacts. 43 had contacts exported. 93 showed no meaningful activity.
• Fix: A permanent change that limits SSO access to the organization that owns the SSO configuration. Brevo plans to re-enable SSO invitations once it ships.

From Trezor's statement on the same incident:

• Trezor dates the incident to 9 September and initially cited 120 affected Brevo accounts. Brevo's later write-up gives 138.
• The phishing email used the subject "Critical Security Alert: STM32 Entropy Vulnerability" and linked to an app download that asked for the user's wallet backup.
• Trezor took the phishing domain down at the DNS level within 20 minutes. About 2,500 people clicked before that.
• In a 17 September update, Trezor said Brevo confirmed 347,149 marketing contacts had been exported through the API.
• Trezor says no Trezor system was touched and it suspended its Brevo account.

How to check if you're exposed

If you use Brevo:

1. Watch for Brevo's direct contact. It says it is reaching out to each affected customer with account-specific details.
2. Review your account's users and any SSO configuration. Remove anyone you do not recognize and any pending invitations you did not send.
3. Check sending history and contact exports for 9 and 10 September. Look for campaigns or transactional sends you did not create, and for export jobs or API activity you cannot explain.
4. Rotate API keys used by your integrations, and confirm each one is still in use.

If you build a multi-tenant SaaS product with SSO:

Test for the same class of bug. Configure SSO in tenant A, invite a user who also belongs to tenant B, sign in through tenant A's identity provider and see whether the session can reach tenant B. A minimal check against your own API:

# After SSO login via tenant A's IdP, the session should only list tenant A
curl -s -H "Authorization: Bearer $SESSION_TOKEN" \
  https://api.yourapp.example/v1/me/organizations | jq '.[].id'

If tenant B appears, your SSO assertion is being trusted for more than the organization that configured it.

What to do now

1. Scope federated sessions to the configuring tenant. An assertion from an organization's identity provider should only authorize access inside that organization. Treat any cross-tenant reach from an SSO login as a critical bug.
2. Restrict who can invite users into SSO. Require that invitations into an SSO configuration be accepted by the invited user, and alert the user's other organizations when it happens.
3. Limit contact export in marketing platforms. If your email provider supports role-based export permissions or API key scopes, keep bulk export to a small group and log every export.
4. Do not rely on DMARC to stop this kind of phishing. Mail sent through your real provider with your real domain will pass SPF, DKIM and DMARC. Your defense is account security at the provider and fast customer warnings.
5. Have a takedown path ready. Trezor's 20-minute domain takedown limited the damage. Know who your registrar abuse contacts are and how to file quickly.

Why it matters

Email service providers sit in the supply chain of almost every company that sends newsletters or receipts. A compromise there lets an attacker speak as you, to your customers, from infrastructure your customers' mail filters already trust.

This incident is also a reminder that SSO is an authorization decision, not only an authentication one. "Who is this user" and "which organizations can this login reach" are different questions. The bug here was in the second one, and it turned a single attacker-created account into access to 138 customers.

Try it yourself

List every third-party platform that can send email or SMS from your domain. For each, write down who can log in, whether SSO is enforced, who can export contacts and whether API keys are scoped. Start with the platform that holds your largest customer list.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Brevo: Incident write-up, attacker gained access to client accounts
• Trezor: Security incident at Brevo, our third-party email provider
• BleepingComputer: Trezor says 347,000 users targeted in phishing attacks after Brevo breach