Uber disclosed a bug submitted by kxyry: https://hackerone.com/reports/366638 – Bounty: $500 [Source]