Vulnerabilities in OpenId Connect Authentication