I disagree with those saying that the impact of this type of attack is minimal.<p>Depending on the application it could significant implications.  Imagine for instance if this was possible in an application, and after switching to the attacker&#x27;s account the victim was tricked into doing an OAuth to some third party service.