Yes, it is a bug, but until it's fixed it's a potential attack vector.