I've found that my website is using id_token and it contains user's information. One of that is my phone number which I think it could be a sensitive information. Because, if the attackers are able to capture the request, they get my id_token and decode it. They have my email (obviously) and my phone number which I think should not be there. I'm confused that if my phone number gets disclosed, is that considered a vulnerability?

email: "[email protected]",
 email_verified: false,
 phone_number: "+372591114xxx",
 firebase: {
  identities: {
   phone: [
    "+372591114xxx"
   ],
   email: [
    "[email protected]"
   ]
  },
  sign_in_provider: "custom"
 }
}.
[signature]