Invision Power Services, Inc. disclosed a bug submitted by mpiosik: https://hackerone.com/reports/2031855 [Source]