Lack of payment type validation in dial.uber.com allows for free rides

Summary

When a rider account had an outstanding account balance, improper validation of the payment method ID provided in the request made it possible to use an invalid payment method. As a result, it was possible to provide a non-existent payment type ID such as xyz when requesting a ride and get the trip for free. In addition to this, the vulnerability was trivial to reproduce and could have been easily abused.

Thanks, @appsecure_in!

Initially reported it as outstanding balance bypass but then turned out to be a free ride bug..