[tptacek]

Kinda makes me hope that the person who does find this vulnerability just publishes:

"I have found a critical vulnerability in this application, which I will demonstrate under NDA to any reporter who requires verification. I will under no circumstances reveal this vulnerability to the vendor or to any other party."