SameSite Lax Cookies - A False Sense of Security?

Hijacking the Family Tree: Exploiting Broken Access Control