Tennessee Valley Authority disclosed a bug submitted by itssixtynein: https://hackerone.com/reports/2043552 [Source]