Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature (CVE-2026-53501) | HOL Guard CVE