CSRF Token Bypass

A web application implements CSRF protection using tokens. You notice the following behavior:

1. The CSRF token is stored in a cookie named 'csrf_token'
2. The application checks if the 'X-CSRF-Token' header matches the cookie value
3. The cookie has SameSite=None

Which attack vector is MOST likely to succeed?