Authentication is absolutely need to get user's personal data. I marked it for secret. As I said with my drawing, victim access to attacker's malicious server using URL and my exploit code on the malicious server executes with 'victim's authentication token'.