it's possible. iff the target sites are stupid enough by not doing proper input validation and/or origin check.
Do you mean a site that uses a third party authentication?
If we need every website out there to code security checks for these third party systems, I doubt we can rely on that