Let's see what we have here:

Out evil attacker now can use these to finish the flow on your behalf and access your data.