How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.
they’ll have this cleaned up in no time, stuff like this happens frequently in cybersecurity. I guarantee you that now this has gone viral, they’ve probably secured the API on their end