A vulnerability in Google’s OAuth implementation allows takeover of old employee accounts when domain ownership changes.