The vulnerability was discovered by a cyber intelligence and hacking group called ZATAZ. Mullvad VPN's API offers access to user information, something called “account_id,” which Mullvad uses instead of actual usernames, emails, and passwords. These “account_ids” are comprised of only a few digits, meaning that it’s easy to use brute force attacks and get private information from the API without any authentication.
This could potentially be a serious issue; however, it’s unclear whether any actual user information (such as an IP address) can be exposed this way. Mullvad has already fixed this security flaw, but there hasn’t been any official statement from the company: nothing on their official webpage or replies to worried Twtter users.
This is probably the most worrying part: VPNs are all about privacy and trust in the VPN service provider: if Mullvad avoids being transparent here, this is a serious hit to their credibility.