Hold onto your butts! Jetstar airlines in Australia has a new login parsing system that is b0rked. It can accept your RFC-compliant-formatted email address as a username, but then when it goes to send a OTP (eww, I hate these types of login!) it fails with an incorrect error message. Pretty sure it’s a terrible regex at fault. Pretty sure that hints it’s exploitable in lateral/unexpected ways. Yes I reported. Yes they ignored me. Yes this information is *freeeeee*.