After discussing with Matthieu Aubry. The original report:

Severity: Critical
Exploitabiliy: Medium
PIWIK version: Piwik 1.12

Consequences:
The risk of leaking a token_auth is very high, which leads to the complete compromise of the account.

Description:
The documentation clearly states that the token_auth is like a password and it should be handled as such. Unfortunately the application doesn't do so. In the same way as passwords are not shown on pages, they shouldn't ever sent back to the client, token_auth should be disclosed in any way.

At the moment token_auths are shown on pages (at least on the admin's users page), stored in hidden input fields in forms, thus, sent in requests. This could potentially lead to the leakage of the token_auth in browser cache, proxy cache.

Although the browser cache can be controlled from the server, but it is not trivial and very much depends on the type of the browser what will it do. If it saves the responses, then an attacker can steal token_auths either by accessing the cache from the browser, or stealing the cache from the filesystem.

Proof-of-Concept:
It was shown that a response with token_auth has been saved in the browser's memory cache. This means that if an attacker has access to a browser that was used to browse PIWIK recently, then he can steal the token_auth. Since not every occurrence of the token_auth was tested it is also possible that some responses would also be saved on the disk.

Recommendation:
The token_auth should never be disclosed as passwords are not disclosed either.