This vulnerability involves a JWT token issuance flaw where the equipment grants a JWT token for each connection in the timeline. During an active valid session, an attacker can hijack the token and reuse an old session JWT token while the legitimate session is still active. This allows the attacker to modify security parameters, access sensitive information, or steal the session without detection by the legitimate user.