Authorization checks msg.sender against tx.origin or uses tx.origin directly. A malicious intermediate contract the victim interacts with can call the target on the victim's behalf, passing the tx.origin check (phishing).
function withdraw() external {
require(msg.sender == owner, "not owner");
payable(owner).transfer(address(this).balance);
}
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0007 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.