websocket 2 IDOR in Password Reset API Leads to Administrator Account Takeover | TheForms Jun 8, 2026 IDOR via WebSocket Subscription – Cross-Order Data Exposure | JoyStick May 16, 2026