How I found a critical bug in one of the biggest GSM Operator’s application that allowed logging into any user account without a password.