Thanks to Jackds Security (@jackds-security) for finding and reporting this issue.

1 vulnerability record and advisories credit this contributor.