I love exploits like these because anyone could figure them out/understand them with a little bit of logic and intuition. No programming background required. (Maybe some automation scripting.)

It's somewhere between Heartbleed and social engineering.