Another very critical yet overlooked problem is that the stolen tokens can be used to obtain access to a user’s account on other websites that support Facebook SSO *even if the user doesn’t use Facebook SSO* to access them.