A request forgery flaw that once leaked internal pages now reaches a link-local address that hands out cloud credentials.