Messaging app discovers vulnerability that has been open for weeks