Cirque du Soleil app gives attackers same admin rights as operators

The developers of the app did not implement any form of authentication.