Not checking the "audience" of a token or misconfiguring it is pretty common. A lot of applications don't actually check it.

since it was sso for their codex/chatgpt account, presumably they used an existing chatgpt github connector available to such accounts.

Somehow the auth'd token for the forum was available within that VM, so having RCE they could've replayed it? idk