Buildbot accepted user-submitted authorization token from OAuth and used
it to authenticate user.
The vulnerability can lead to malicious attackers to authenticate as legitimate users
of a Buildbot instance without knowledge of the victim's login credentials on certain
scenarios.
If an attacker has an application authorized to access data of another user at the
same Identity Provider as the used by the Buildbot instance, then he can acquire a token
to access the data of that user, supply the token to the Buildbot instance and successfully
login as the victim.