Unverified50% confidenceFactExact time
Traditionally, refresh tokens are mostly transmitted in Bearer form, and any party holding the string can use it; common leak paths include client logs, insecure storage, man-in-the-middle attacks, and malware in public clients.
1
Sources
50%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe exposure of username-to-email address mappings can be used for cross-platform credential stuffing attacks, particularly against users who reuse the same password.76% similarUnverifiedSensitive user information accumulated in noreply mailboxes can support identity theft, account takeover, and even financial fraud.74% similarUnverifiedStolen API tokens can be used to impersonate victims when calling services, execute automated tasks to consume quotas, be resold, and send violating content leading to account bans.73% similarUnverifiedPhishing specifically refers to attackers disguising themselves as trusted entities and using forged communication channels to obtain accounts, passwords, or payment information; when the medium is text messages, the industry usually calls it SMS phishing (Smishing).71% similarUnverified会话泄露指某个用户的登录状态、身份令牌或临时数据被错误关联到另一个用户或工作区71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1076442API
curl https://kongchang.com/api/v1/knowledge/claims/1076442MCP
get_claim(id=1076442)