A session token is a temporary code that a service issues after you sign in, so you stay signed in without entering your password on every request. Your browser or app sends the token with each request, and the service uses it to recognize you. It may be stored in a cookie or in the app, and it normally expires after a set time or when you sign out.
Because the token stands in for your login, anyone who holds a live one can usually act as you without knowing your password. Depending on how the service is built, that can also bypass multi-factor authentication, since the second factor was already completed when the token was issued. Tokens can be stolen through malware, compromised browsers, intercepted traffic or a breach of the service that stores them.
Exposure of a token does not always mean it is usable. Tokens that have expired, been revoked or are bound to a device or network may no longer work, and providers differ in how they handle this. A token seen in a leaked dataset should be treated as potentially live until the service confirms it has been invalidated.
If you think a token has been exposed, sign out of all sessions, revoke active sessions in the account settings where available, and change your password. Service operators should invalidate the affected tokens, shorten token lifetimes and monitor for sign-ins from unexpected locations.