The vulnerability hinges on unauthenticated access token manipulation. Hackers can exploit this flaw to update or delete access token configurations for the affected extensions.

Source: Infosecurity