Hackers are using OAuth as a loophole to retain access to user accounts. Password resets won’t help, and even multi‑factor authentication can be evaded.