F-130 — cross-origin JWT theft → account takeover

Two steps: (1) read the viewer’s JWT out of a verbose error body cross-origin, (2) replay it to fetch the account’s PII. The PII is POSTed to this server as proof.

Prerequisite: the viewer holds an access_token cookie (the app writes it as Bearer <jwt>). Open any LendingTree form first if not.
page origin
1. steal JWTpending
2. replay → PIIpending
3. exfil to serverpending