This looks like a sloppy design to me, that degrades performance by storing more tokens than necessary. But I don't see a security issue.
Why? To bypass the CSRF-filter the attacker would need to know the value of a token. But there is no leaking of that info in your example, just multiple tokens. Only difference is that an attacker has two in a billion instead of one in a billion chance of guessing it right.
One thing to investigate further, though: The CSRF token should be tied to the session. That it still works after login makes me suspicious. Does any CSRF token work with any session ID? Then you have no CSRF protection at all. Or doesn't the session ID change when you login? Then you have a session hijacking problem.