[ddlatham]

You're missing something in your definition of a second-preimage attack, which is that Y != X.

[Gankro]

Ah good point. It could be that the first-preimage attack gets you exactly X, in which case it fails to handle second-preimage. I would expect this to be incredibly unlikely (especially since they seem to generally involve generating some random garbage). I would also expect most first-preimage attacks have a way to "continue" to a third value, eventually.

[shawabawa3]

That's kind of implicit.

If X = Y, it's not an attack, it's the primary purpose of hashing