Internet Bug Bounty disclosed a bug submitted by tniessen: https://hackerone.com/reports/2225660 – Bounty: $2330 [Source]