API open authentication vulnerabilities discovered by researchers