yeah bro
but it wont be possible to exploit cors
as it requires a genuine user to login to steal their creds and who will you send it to…
I thing we just need to do bruteforce