Unverified50% confidenceFactExact time
According to XBOW, the attack was never used against real users before the fixes.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedXBOW did not disclose the specific vulnerability numbers, the technical components used, or the complete exploit code in this communication, providing only a description of the results.63% similarUnverifiedTokens stored in memory are lost after a page refresh, but are more secure because XSS attacks cannot read them via document.cookie or localStorage58% similarUnverifiedThe attack did not break any encryption algorithms; encryption is performed on the server side, and no cryptography was compromised.56% similarUnverified早期版本的 Marked.js（CVE-2017-1000427）和 showdown 等库曾因对用户输入过滤不足导致 XSS 漏洞被公开披露53% similarUnverified攻击者获取refresh_token后即可持续刷新获得新访问权限，即便用户修改密码，已泄露Token在过期前仍可被持续滥用，这称为会话劫持53% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1027861API
curl https://kongchang.com/api/v1/knowledge/claims/1027861MCP
get_claim(id=1027861)