Nobody said we were polished. We’re literally the upstart underdog.
It is known about, and it’s being worked on, but since it’s ultimately an open source project, there’s no deadline provided for when it will be fixed.
Luckily it’s not a big deal, it doesn’t prevent the pending subscriptions from showing up in your feeds. If it bothers you just wait for your server to be not busy, unsubscribe and resubscribe, should take care of it.
There was a different vulnerability found that let the attacker take full ownership of a compromised account - some moderator and admin accounts were compromised. I would prefer the developers fix that first.