Post

PSA: Don't click links you cannot vet. Be smart. Phishing is the most common form of compromise.

How the heck is this even possible in 2026? Why is a random webserver getting sent your discord oauth token? Or are people getting sent to a discord oauth page and unknowingly allowing it to auth as them?

It's simultaneously sending the current session token for Discord plus anything you're logged into on the browser. Like, everything. It should be something easily patched but man, I don't know.

Googling seems to indicate it requires you to authorize their oauth app. Like, I don't think it's just "link opens, you're cooked" But it's also not super clear, since most places aren't going into the technical details.