Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory.
CWE-94 Improper Control of Generation of Code ('Code Injection')