Spot The Vulnerability 10-11-2022

<title>Login Frame</title>
<script type="text/JavaScript">
  const allowed = [
    window.location.host, "localhost"
  ];

  window.addEventListener('message', (event) => {
    const anchor = document.createElement('a');
    anchor.href = event.data.domain;

    const isAllowed = allowed.filter(d => {
      return d === anchor.host
    }).length > 0;

    if (isAllowed) {
      const data = {
        token: localStorage.getItem('accessToken')
      };
      window.parent.postMessage(
        data, event.data.domain
      );
    }
  });
</script>

an attacker can append his domain address to allowed list.
Then send a window.postMessage() from his domain address