Comment by Globz

10K for this kind of vuln is very cheap on their part.

This is serious when you consider that they are moving millions of transactions every day...

CSRF valid for ALL users, ouch!