The vulnerability stemmed from the server-side token caching mechanism. Key evidence includes:

1. The patch removed the __tokensCache initialization and all cache interaction logic
2. The @gTokensSync decorator (for cache synchronization) was removed
3. The getCachedToken check was eliminated from the token retrieval flow
4. Documentation changes emphasize removal of server-side caching
5. The vulnerability description explicitly states cached tokens were accessible across users

The export_getToken function was vulnerable because it served cached tokens without re-validating permissions, relying solely on the initial token request's authorization check rather than subsequent cache accesses.