A lot. An attacker with control of a subdomain on your primary brand can host phishing that passes SPF/DKIM alignment, steal cookies scoped to .yourbrand.com, bypass CORS on the parent domain, and abuse OAuth redirect allow-lists. If session cookies aren’t domain-scoped strictly, a takeover on abandoned.brand.com can hijack sessions on app.brand.com. Under GDPR and HIPAA, credential theft on a customer-facing subdomain is a reportable data-processing incident.
All questions
How much damage can a subdomain takeover cause?
Read the full guide
What Is a Subdomain Takeover? (And Why Microsoft Had 670 of Them)
Subdomain takeover is the class of bug where a `CNAME` points to a service you already gave up — like an old S3 bucket, an expired Azure Cloud App, or a decommissioned Heroku dyno. An attacker registers the abandoned resource, and now they serve traffic from your subdomain.