An account takeover vulnerability has been discovered in a popular online travel service.