Tomorrowland SSO — cross-origin token theft (origin.endsWith bypass)

Origin:  |  a logged-in Tomorrowland visitor's SSO tokens are stolen below.

Loading official login.tomorrowland.com/lib/tml-sso.iife.js and requesting the visitor's SSO session…