What is this torrent passkey used for? My understanding is that torrent trackers were all about sharing peers. You want tracker info to spread. I'm not understanding what this vulnerability exposes.
Edit: It looks like it's actually explained earlier:
> One begins with a GET request to another tracker, which responds with a torrent file. It’s then uploaded to the requesting site which updates its SQL database accordingly.
> From there the script starts checking for any new entries on a specific RSS feed which is hidden away on another site that has nothing to do with torrents. The feed is protected with a passkey but that’s only useful when nobody knows what it is.
> The same security hole also grants direct access to one of the sites tracker ‘bots’ through the panel that controls it.
So I think the issue is that keys to authorize control of the automated software to propagate tracker info is being leaked. It sounds like the end result is someone can write spoofed or spam info into torrent trackers.