Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/

Stripe disclosed a bug submitted by mr_asg: https://hackerone.com/reports/1685970 – Bounty: $13000