I think it's much more efficient to do the deletion like this:
DELETE FROM AccessTokenVO WHERE id IN ( SELECT at.id FROM AccessTokenVO at JOIN at.authentication t WHERE t.hash = :hash )