Comment by pja

If the oauth wall is managed by PHP, then it looks like the answer is yes, you’re vulnerable to client connections that haven’t logged in.

This looks like a bug in PHP’s assembly of multipart responses & you can feed one of those to the PHP backend with a simple web request, no auth required I think.