PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

Token leak in security challenge flow allows retrieval of PayPal email and plain text password. Sensitive, unique tokens leaked in JS file used by recaptcha implementation. User must solve CAPTCHA after authentication, then tokens used in POST request to solve CAPTCHA. Method identified to expose security challenge token to third party via XSSI attack. Malicious site could trigger authentication request replay and expose user's password. Exposure occurs if user follows login link from malicious site. PayPal implemented additional controls on security challenge request to prevent token reuse, resolving the issue with no abuse evidence found