Update: turns out the vuln is totally real. But the circumstances of the leak were still fishy imo.