HackerOne Bug Bounty Disclosure: force-user-to-accept-attacker’s-invite-[-restrict-user-to-create-account]bysammam