An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.