Unauthorised access to pagespeed global admin at https://webtools.paloalto.com/

How it was found

Summary:

I came across this subdomain https://webtools.paloalto.com/ which took my attention, after a bit enumeration I found an endpoint which allows anyone to access PageSpeed Global Admin without any type of authentication.

Vulnerable URL:

https://webtools.paloalto.com/pagespeed-global-admin/

Impact

You better know what can be done here.