REAL-1872 — Figma MCP OAuth DCR → Account Takeover

Unauthenticated DCR → first-party identity impersonation → unvalidated redirect_uri → token theft → PII exfiltration

Phase 1 — Dynamic Client Registration + Identity Impersonation

↓

Phase 2 — Victim OAuth Consent (1 click)

↓

Phase 3 — Auth Code → Access Token (server-side)

↓

Phase 4 — PII Exfiltration