HackerOne disclosed a bug submitted by abhhinavsecondary: https://hackerone.com/reports/2061367 [Source]