I'm working in a new clients system, and they automatically assign permissions based on the domain name for the email address the account was created under (they do require validation via an email).
They check that the email ends with
@somedomain.tld. For large banking corporations. If you have the appropriate domain name you will have full access to employment histories, address histories, SSNs....etc for a cuople million people. These are 3rd party domains (that are used for the email addresses), are under no control of the aforementioned client operating this system. And are the company email addresses of whomever owns those domains. There are ~500 domains whose email addresses have access in this manner.
Are there security pitfalls with this? Are there exploits that have been used to work around such systems?
My goal is to do some due diligence since at first glance this seems like a fragile way of authorizing access to such information. But I do not have the knowledge to say if it is or is not. I would also like to know, outside of the scope of the above scenario, if there are pitfalls and issues with this sort of setup, regardless of the type of role or risk.