Credited Craig Heffner for discovering the vulnerability.