Same team found a similar vulnerability last year in grub:

http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-by...