The critical, unauthenticated bugs allow attackers to bypass authentication and proxy a user’s browser traffic.