I wasn't arguing the spoofing part but the important vs. critical part. The same bug for ankther platform is ranked as critical.

The thing is that according to Microsoft critical spoofing is not possible.

> Isn't that precisely what spoofing is?

Not in my opinion. I’ve always thought of spoofing as a write only type thing where you can impersonate someone, but not have access to any of their existing data. Email spoofing is a good example of this.

Token theft is WAY more severe because it gives you complete access to everything. It’s total control. You can exfiltrate data and that’s what I’d consider the biggest difference, at least in my opinion.