This is a copy paste of 🐛 [security] Anonymous users can reuse credit cards of others when payment token is set to always Fixed , the relevant code is based on that project where we discovered that problem.
When using the token setting to always store a payment method reference, which only makes sense in combination with custom code that then does something with that (setting up subscriptions in our case), then the ID for anonymous users is not handled correctly, which results in anonymous users being able to reuse stored credit cards.
Reporting this in public because this module is not stable and it's unlikely someone used this setting.
Fixed
1.0
Code
Automatically closed - issue fixed for 2 weeks with no activity.