>As a result, this behavior can lead to a serious vulnerability if the client application doesn't properly check that the access token matches the other data in

>As a result, this behavior can lead to a serious vulnerability if the client application doesn't properly check that the access token matches the other data in the request. Later they use this language the clarify the situation. I suppose the situation being described is when the token has no information that can track to a specific user id. I guess devs are just checking that a token decrypts and aren't verifying it matches the user id in the request? Seems like basic security 101.