The vulnerability is that there was no public key encryption, hence allowing a MiTM to redirect the steam app to their own site.