So?
Passwords are normally the first step. A password grants some sort of token or cookie. Did they do the proper back-end checks on authorization (after the token authenticates)? Common stuff like that is normally overlooked. The front end app does some auth check and then calls a backend api, but the same auth isn't done on server side. That stuff happens all the time.