The vulnerability exists in OAuth (social sign-in), used by almost every website today.
If you are unfamiliar with OAuth, the post (in the first comment) explains it step-by-step with detailed diagrams.
Researchers took over Booking.com accounts using a legitimate Facebook link
1–2 of 2 posts