HackerOne disclosed a bug submitted by imranhudaa: https://hackerone.com/reports/2069593 – Bounty: $2500 [Source]