Expired60% confidenceFactExact time
Top-up services require users to submit the session credentials (Session Token or Cookie) of their accounts; a third party holding these credentials can fully impersonate the user and initiate all operations, including subscription payments, modifying account information, and accessing conversation history.
2
Sources
60%
Confidence
Medium-term (~90 days)
Relevance
7/4/2026
First Seen
Valid until: 10/2/2026(expired)
Sources
Related Claims
UnverifiedAfter a user logs in, Cursor stores session credentials (Session Token) locally.75% similarUnverified第三方平台通过读取Cookie确认账号归属，本质上借用浏览器已登录状态而非要求明文密码，但仍存在会话劫持风险73% similarUnverifiedAccount-sharing tools most likely implement account switching by modifying Cursor's authentication token storage (such as Session Tokens in local configuration files or the system credential manager) rather than by modifying the Cursor executable.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/112086API
curl https://kongchang.com/api/v1/knowledge/claims/112086MCP
get_claim(id=112086)