Uber disclosed a bug submitted by kxyry: https://hackerone.com/reports/201326 – Bounty: $2000 [Source]