Internet Bug Bounty disclosed a bug submitted by tniessen: https://hackerone.com/reports/2256167 – Bounty: $3495 [Source]