India's Koo, a Twitter-like Service, Found Vulnerable to Critical Worm Attacks

Using cross-site scripting, an attacker can perform actions on behalf of users with the same privileges as the user and steal web browser's secrets, such as authentication cookies.