HackerOne disclosed a bug submitted by buraaqsec: https://hackerone.com/reports/1868473 – Bounty: $2500 [Source]