How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.
It is using HTTPS, but all you need to get the full PII dump is a last name and calculable PNR number. No other authentication required.