Khan Academy ClickJacking to Steal Users's Credintials
该报告还没有中文解读。
原文摘录
摘自原文（930 字符中的一小部分）
1. It ask to login to https://alerta.khanacademy.org with google account. 2. It doesn't give access to any normal user. 3. That's why after trying to login with GOOGLE account it shows a error message prompt with user's sensitive information including [email, code/access token and client id etc.] …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Khan Academy 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @hack_im · 版权归作者与 Khan Academy 所有