Notify the NCSC as soon as possible via the form before making it public to the outside world. Such a report is called a Coordinated Vulnerability Disclosure (CVD).
DigiD works together with the National Cyber Security Center. Together with the NCSC we proces your finding and resolve it as quickly as possible.