Cloudflare Public Bug Bounty disclosed a bug submitted by mega7: https://hackerone.com/reports/1615743 [Source]