Internet Bug Bounty disclosed a bug submitted by balis0ng: https://hackerone.com/reports/2208656 – Bounty: $540 [Source]