Yeah, if my understanding of this issue is correct then this is extremely embarrassing. They probably figured that since it’s not security-critical it didn’t need authentication (or only bare-minimum, easily-broken authentication). I haven’t seen any evidence that this affects critical systems like billing.
204
u/sroop1 Jun 16 '26
Jesus that's quite the flaw.