Comment by vortico

Any site that has a GET route to /logout that does not check the referrer is vulnerable to this iframe/img attack.