Device binding flaw lets attacker take over another account's device

An attacker can make the server unbind a target device from its current owner and rebind it to the attacker's own account, even when the device belongs to someone else. The attacker then obtains the device's full serial ID.

Summary written from the sources below. Check the originals before acting.