Hi, it’s better not to post about things like this on a public forum. Details of a possible vulnerability are visible to everyone here. Please send everything you have, including steps, affected endpoints, and examples, to [email protected]. That’s the official channel for vulnerability reports, listed at Cursor · Security.
Also, if you can, please edit the post and remove the technical details.
joker 
I’ve discovered a bug that grants an unlimited quota: accounts with legacy subscription plans can access the Opus 5.5 model without any usage limits simply by logging in. Furthermore, it’s even possible to use the old API endpoints to forcibly reactivate those discontinued subscription plans.
You can log in and use your account directly, without needing any extra steps or workarounds.
Windows 10/11
MacOS
Linux
You can log in and use your account directly, without needing any extra steps or workarounds.
Yes - Cursor is unusable