Framable authenticated page

Tags: clickjacking, csrf, xs-leak

Typical severity: P4-P5

What it becomes

Usually P5. Becomes real when a sensitive state-changing UI is framable (disable 2FA, OAuth approve, delete, wire).

Where to look

• OAuth consent

  Copy

• disable 2FA

  Copy

• delete account

  Copy

• confirm payment

  Copy

• admin toggles

  Copy

Chains

• CSRF-like state change — Overlay the target button under an attacker UI. Victim clicks.
• XS-Leak — Frame counting, window length, or timing to infer login state or search hits.

Notes

• Most programs want a working PoC of a sensitive action, not 'the homepage is framable'.
• CSP frame-ancestors beats XFO. Check both. Report the one that is actually missing on the sensitive page.