A server-side request forgery flaw could have allowed threat actors to steal people’s login credentials ...