U.S. Dept Of Defense: Unauthenticated access to internal API at██████████.███.edu [HtUS]

There was unauthenticated access to internal API at██████████.███.edu. Multiple API calls allowed an attacker to gain access to the internal API via the Azure API url appg3entcalapi.azurewebsites.net. The access to█████.██████.edu was only supposed to be available to internal users...