API vulnerability in airline-linked travel service exposed millions to account takeovers, booking fraud, and data theft ...