Cross-posting a security advisory I wrote up at work. The actual mechanics of the issue are kind of boring, but I found some interesting stuff to work on in it anyway!