Anyone know the current state of these vulnerabilities? The post says it was updated in April 2016.
They still exist and (as far as I know) there are no plans to do anything about them. We (thankfully) were alerted to this issue by HackerOne before it was an issue, but this remains an absurdly easy attack vector...