HackerOne disclosed a bug submitted by todayisnew: https://hackerone.com/reports/2035332 – Bounty: $500 [Source]