The node in the mint() function is calculated as node = keccak256(abi.encodePacked(_delegator, _maxAllowance, tokData));. While in burnOrSwapExternalToMint() it is node = keccak256(abi.encodePacked(_tokenId, tokData));
Since the token data is variable, it can be crafted to make the node from one function match the other. Since both functions use the same merkle root, the proof would be valid.
Include some identifier if the same merkle root will be used for proofs with different data. Also hash the token data.
