Sounds like a storm in a teacup if indeed the endpoint is served over TLS.
There exists a vulnerability, because the Peach tokens (seemingly) never expire, and thus are vulnerable to replay attacks.
However, because authorization uses TLS, it's very unlikely it will be exploited, because TLS mitigates MITM attacks.