Have you been through some sort of responsible disclosure? I don't know enough to tell if this is an immediately usable vulnerability.