Plaid TABE — Same-Origin XSS on cdn.plaid.com

What this proves

Arbitrary JavaScript execution in the cdn.plaid.com origin. The attacker controls the redirect_uri parameter and the JWT tabe_uri field. No signature verification on the JWT. No scheme validation on redirect_uri.

Attack URL

Steps to trigger

1. Click the red button below — it opens cdn.plaid.com with the crafted parameters.
2. A bank login screen ("Demo Bank") appears — this is the TABE credentials pane rendered by Plaid's real code.
3. Click the X (close button) in the top-right corner.
4. An exit confirmation appears: "Are you sure you want to exit?"
5. Click "Yes, exit".
6. alert() fires showing cookies — JavaScript executed in cdn.plaid.com origin.

Impact

• Cookie theft — steal __Secure-sfpc and any other cookies on cdn.plaid.com
• Session fixation via cookie toss — inject attacker's SFPC cookie to hijack bank connections across 8,000+ apps (Venmo, Robinhood, Coinbase, etc.)
• Credential phishing — modify the DOM to capture bank credentials in a legitimate-looking Plaid flow
• Full DOM control — read/write any element, exfiltrate data, redirect user

Sink: window.location.assign(redirectUri) in flink.js
Source: redirect_uri URL parameter — no sanitization
Root cause: JWT decoded with atob(), no signature verification