critical security flaw