I reported the same vulnerability to a company with millions of users last week, as of now it is still not fixed ...