We sent the HTTP request using our CRLF-appended victim account to attempt to remotely unlock the vehicle connected to the victim's email address. The service took a few seconds, then finally returned "200 OK".@_specters_ confirmed that his car had unlocked!

— Sam Curry (@samwcyo) November 29, 2022