Passport flaw leaves user info up for grabs