Internet Bug Bounty disclosed a bug submitted by tniessen: https://hackerone.com/reports/2091137 – Bounty: $2540 [Source]