Chaining

When You Get Your MCP Wrong: Second-Order XSS to Cloudflare Access Account Takeover