I need advice from experienced bug bounty hunters about a report that was closed as Informative despite my attempts to explain the attack scenario and demonstrate the security impact.

For privacy and responsible disclosure reasons, I am withholding the affected company's name, target domain, exact endpoints, confirmation tokens, report ID, and other identifying details.

The vulnerability I reported

I discovered unexpected behavior in an application's email-change confirmation flow.

When a user changes their account email address, the application sends a confirmation link.…