CORS misconfiguration PoC — this page read your Kruidvat session data cross-origin via your cookies, from a domain you don't own.
api.kruidvat.be — credentialed cross-origin read
Sending request with
credentials: include
…
Raw response (evidence)