An engineering student in Kochi, India has managed to bypass Apple’s anti-theft Activation Lock feature found on its iOS devices. The final-year mechanical engineering student named Hemanth Joseph had previously received upwards of $7,500 from Google earlier in the year for disclosing a bug in its cloud platform.

Joseph said that he can bypass the iOS Activation Lock on an iPhone or iPad when it has been locked using the ‘Find iPhone’ app. He managed to achieve this by taking advantage of the lack of any character limit in the input fields for name, username, and password.

In his blog post, Joseph reveals that he purchased a used iPad Air for his friend from eBay which had its Activation Lock enabled. When the iPad prompted him to enter a username and password to disable the Activation Lock, he used the unlimited input field to his advantage to crash the iCloud layer. The process did involve him using an iPad Smart Case to lock/unlock the device.

The vulnerability discovered by Joseph works on any iPhone or iPad running iOS 10.1.1, though he had already informed Apple about this in early November. It is likely that we will see the Cupertino company fix this bug in the upcoming iOS 10.2 update.