Forcefully Joining Private Servers via Shared Invite ID Namespace
How I discovered that a staging environment shared its invite ID namespace with production, allowing an attacker to generate invite codes on staging and use them to forcefully join random private servers on production — including invite-only ones.