API bug in OAuth dev tool opened websites, apps to account hijacking | Heykuki News