Unverified50% confidenceFactExact time
恶意站点可利用伪造的OAuth授权请求，在真实页面上诱导用户授权，从而无需获取密码即可控制账号
1
Sources
50%
Confidence
Long-term
Relevance
7/22/2026
First Seen
Sources
Related Claims
UnverifiedHolehe determines whether an email address is registered by exploiting behavioral differences in websites' forgot-password and registration interfaces, rather than through brute force or credential stuffing.66% similarUnverifiedThe User-Agent field in HTTP requests is declared by the client itself; the HTTP protocol has not introduced any authentication mechanism for this field, and anyone can freely forge it.65% similarUnverifiedAttackers can bypass two-factor authentication by stealing session cookies to directly impersonate a user's identity.65% similarUnverified跨站提示注入攻击指A网站的恶意内容可能污染智能体处理B网站任务时的行为64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/593646API
curl https://kongchang.com/api/v1/knowledge/claims/593646MCP
get_claim(id=593646)