The Patching Friars' AlmanacA calendar of CVE saints

April 20

GhostTokenHoly card for ghosttoken, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 G GhostToken SPIRITUS MANET
🤖 Image and text generated with AI

⬇ Download holy card: ·

⚔ Commemorated today: The Great Silence of the PlayStation (2011)

Embed on your site

Blessed GhostToken, the Phantom App

Patron of OAuth apps, cloud projects pending deletion, and guests who never leave.

Life

On 20 April 2023 Astrix Security described GhostToken, a Google Cloud flaw reported in June 2022. A malicious app, once authorised by a user, could make itself invisible and impossible to remove from the Google account's access page, by putting its own project into pending deletion and bringing it back to life when needed. Google fixed it in April 2023: apps in that state now show up in the list too.

Prayer

O Blessed GhostToken, who dwells in the account unseen, let every authorised spirit have a name and a button to cast it out. Amen.

How to celebrate

Celebrated by opening your Google account's connected apps page and kindly dismissing those no longer needed.

An unseen guest is a guest forever.

Technical record

Disclosed on
April 20 2023
CVE
No CVE: blessed, not yet canonized by MITRE

Sources: astrix.security

Commemorated today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.