IP Spoofing to Account Takeover: You Patched It? Really?

Explains how an OAuth patch was bypassed using IP spoofing and chained bugs to achieve account takeover, revealing flaws in authentication defenses.