Very good catch. You should file CVEs for these, since it's about as hair-on-fire bad as a security bug can be!

News at 5: Library for securing tokens doesn't secure tokens.