The issue is an information disclosure affecting Microsoft Exchange Server. It involves an authentication bypass, specifically through a flaw related to delegated authentication and the handling of the `SecurityToken` cookie. An unauthenticated attacker can leverage this to gain access to mailbox configuration parameters, potentially altering email forwarding rules and modifying the Exchange Control Panel (ECP) configuration. This allows for the mirroring of email traffic and access to sensitive information. The vulnerability, known as ProxyToken, is based on a combination of the `SecurityToken` cookie and an HTTP 500 error containing a valid string. The issue could reveal personal information and sensitive company data.