Aiven Ltd disclosed a bug submitted by jarij: https://hackerone.com/reports/1418891 – Bounty: $6000 [Source]