Are they have bug bounty program? If they don't have and you are not hacking with their permission, you are doing illegal hacking so they can take legal actions against you, although your finding is valid.