Aiven Storybook 0-Click DOM XSS → Account Takeover

Target: aquarium-library.aiven.io (Aiven Aquarium design-system Storybook)
Main app: console.aiven.io / api.aiven.io
XSS type: 0-click DOM XSS via React Element Revival ($$typeof Symbol bypass)
Interaction: 0-click for cookie theft. 1-click (credential entry on trusted *.aiven.io) for ATO.
Impact chain:
  Phase 1 (0-click) — XSS fires, exfiltrates .aiven.io cookies (PostHog distinct_id linking to console identity), localStorage, Snowplow CORS probe
  Phase 2 (0-click) — Replaces page with fake Aiven login on trusted *.aiven.io domain
  Phase 3 (1 interaction) — Credential capture → POST /v1/userauth via CORS → auth token + email + user_id → GET /v1/me → real name, projects, infrastructure (full ATO)

Direct PII note: Auth is purely Bearer token in console.aiven.io localStorage (different origin, inaccessible). api.aiven.io CORS has no credentials:true. Direct API access without credential phishing is not possible — the ATO chain is the only path to full PII.