Vulnerabilities in OpenID 2.4