I agree this is a very serious security bug. Maintainers, could you please take a look at the patch posted in this bug report ? The patch doesn't works if the administrator specify more than one interface. It fallbacks to 0.0.0.0 if more than one interface is specified but this is much better than current behaviour.
version 0.2.11
Support brute force prefix
VERSION 0.2.10: Fixing typo