An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
NVD-CWE-noinfo, CWE-284