HackerOne disclosed a bug submitted by as_patro: https://hackerone.com/reports/2109382 – Bounty: $1000 [Source]