[Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth

Summary

We have resolved an issue in Cloudflare Access where an exploit chain involving a SAML endpoint could allow for unauthorized approvals within the Temporary Auth workflow. This has been fully remediated, and we thank the researcher for their help in hardening our authentication flows

Detailed Writeup: https://kazama.in/self-xss-to-cloudflare-single-click-approvals/