LNBits is vulnerable to this.
this has been reported quite a while ago. there is some discussion somewhere on github.