Also QA wouldnt find stuff like this.
QA in general has no technically knowledge or coding ability.
This is found with Application Security Testing.
If you dont have an Application Security team it's time to make one or hire some mercenaries(contractors).
https://www.cigital.com
https://www.bishopfox.com