Google taking really long to fix a bug

I found what (I think) is a pretty bad google oauth scope bypass bug. It only got a S2, but it allows apps, without any restricted scopes granted, full google drive access. Ie read write everything. This was feb 2025 and it still isn't fixed. They have been saying the fix is close since September last year. Is this normal? It seems like not too complicated of a fix to me, even without breaking changes. Unfortunately it was a duplicate known internally, so I don't get paid, but I'm invested as it affects me and my users. submitted by /u/hillac [link] [comments]