Comment by pm90

I don’t think I understand the attack scenario that this flow prevents even after reading the rfc. Can anyone explain?