> GitHub states that this bug could not be intentionally triggered by a malicious party (why?), Because this bug requires two users making authenticated reques

> GitHub states that this bug could not be intentionally triggered by a malicious party (why?), Because this bug requires two users making authenticated requests at nearly the same time. An attacker cant force their target to perform actions, especially not in the same small time frame that is likely required (milliseconds? less?). I suppose if the malicious party didnt care what account they got swapped into, and github didnt rate limit their requests, perhaps they could trigger this bug with enough time?