Brevo Security Review: Lessons from SSO and Supply-Chain Incidents
In short
Two September 2026 incidents exposed authorization gaps in Brevo’s SSO and a hardcoded Cloudflare credential. The platform restored service quickly, yet the events underscore script and credential risks for email marketing users.
Brevo security review of the September 2026 events shows that both the SAML SSO flaw and the later supply-chain compromise were contained within hours, yet they affected customer sites and email campaigns. The company, formerly Sendinblue, maintains ISO 27001 certification and GDPR support, but the incidents reveal concrete weaknesses in authorization boundaries and credential management.
Brevo Security Review of the September 9–10 SSO Incident
Attackers created a Brevo account, enabled SSO, and invited legitimate users across organizations. The authorization failure allowed access to 138 customer accounts. Six of those accounts sent phishing messages, including a fake Trezor security alert that reached roughly 347,000 subscribers. Contacts were exported from 43 accounts.
Brevo detected the activity around 06:30 UTC on September 10 and closed the vector by 08:30 UTC. It reset sessions for affected accounts and notified customers. Ninety-three accounts showed no attacker activity beyond initial access. No further misuse occurred after containment.
The incident affected organizations using Brevo for newsletters and contact management. Major clients such as eBay and Louis Vuitton rely on the platform, though none were named in the breach reports. Brevo’s status page recorded the issue as resolved the same day.
Supply-Chain Attack via Cloudflare Worker on September 14
A long-lived Cloudflare API key hardcoded in Brevo source code allowed deployment of a malicious Worker. The script ran for four to five and a half hours and injected ClickFix overlays on brevo.com, sibforms.com, and three customer JavaScript files. Sansec estimated more than 100,000 sites referenced the affected scripts.
The Worker attempted to deliver social-engineering prompts and WordPress plugin backdoors. Brevo removed the Worker, revoked the key, purged caches, and verified clean files by September 15. Core services including app.brevo.com, the API, and stored customer data remained untouched.
Comparison of the two events illustrates distinct attack surfaces.
| Aspect | SSO Incident | Supply-Chain Incident |
|---|---|---|
| Date | September 9–10, 2026 | September 14, 2026 |
| Vector | SAML authorization flaw | Hardcoded Cloudflare key |
| Impact scope | 138 accounts, phishing via 6 | Script injection on customer sites |
| Data at risk | Contact exports | Visitor malware exposure |
| Containment time | Under 2 hours | 4–5.5 hours of active script |
Practical Steps After the Brevo Incidents
Brevo replaced the hardcoded key with short-lived scoped tokens and added Cloudflare event monitoring. It also fixed the SSO scoping issue permanently. Customers received guidance to review installed plugins, scan for malware after ClickFix exposure, rotate credentials, and enable IP restrictions plus two-factor authentication.
Site owners using Brevo forms or widgets should audit logs for unexpected script loads between September 9 and 15. Administrators can check browser console errors or use automated scanners to detect injected code. Organizations handling sensitive contacts may add Brevo logs to their existing SIEM systems.
Pre-incident reviews noted Brevo’s EU data centers and MFA options as adequate for standard marketing use. Post-incident hardening includes edge configuration reviews, though independent verification of all changes remains limited in public reporting. Users weighing Brevo against alternatives should examine how each platform manages third-party credentials and SSO boundaries.
Frequently asked questions
Is Brevo safe after the September 2026 incidents?
Brevo contained both issues within hours and implemented fixes including short-lived tokens and SSO scoping corrections. No ongoing unauthorized activity has been reported since mid-October 2026, though customers should still review their own site scripts and logs.
What data was exposed in the Brevo SSO incident?
Contact lists were exported from 43 accounts. Six accounts sent phishing emails. Core stored customer data and email delivery systems were not accessed.
How long did the ClickFix script run on Brevo sites?
The malicious Cloudflare Worker operated for roughly four to five and a half hours on September 14 before Brevo removed it and cleared caches.
Should users rotate Brevo API keys now?
Brevo advises rotating credentials and enabling IP restrictions plus two-factor authentication. Organizations that embedded Brevo scripts should also scan for unauthorized plugins or injected code.
TrustScope
Comments 10