In the writeup, they say there's multiple other vulnerabilities on this attack surface, but they're still working on responsible disclosure.