A lot of details is in linked curl hackerone: https://hackerone.com/reports/2550951