This vulnerability was independently reported with a very helpful PoC by dawu@knownsec 404 team and Sunflower@knownsec 404 team

1 vulnerability record and advisories credit this contributor.