A chained issue enables account takeover and remote code execution. An overly permissive Cross-Origin Resource Sharing (CORS) configuration, where `allow origins` is set to '*' and `allow credentials` is set to `True`, combined with a refresh token cookie configured as `SameSite=None`, allows a malicious webpage to perform cross-origin requests that include credentials. This allows an attacker-controlled origin to call the refresh endpoint and obtain fresh `access token` and `refresh token` pairs for a victim session. These tokens provide access to authenticated endpoints, including built-in code-execution functionality, allowing the attacker to execute arbitrary code and achieve full system compromise. This issue has been actively exploited in the wild.