A quite common error, actually. Lots and lots of services are configured to accept logins from arbitrary auths, but forget to verify that it's an auth they actually trust! You just check that it's a valid oauth token, and your code works for your login page, so you consider your login-feature to be done and move on to something else, leaving a wide open door.

Edit: As the article itself stated, around 25% of all systems with this setup are vulnerable!

> The results surprised us: 25% of all the multi-tenant apps we scanned were vulnerable to authentication bypass.