That is indeed another vulnerability of Discord.

Discryptor doesn't even require you to be logged into your Discord account (except for the authentication every now and then).