ecrecover returns address(0) for invalid signatures; if unchecked and signer can be 0, auth is bypassed. Raw signatures are also malleable (s,v variants) enabling a second valid signature.
address s = ECDSA.recover(h, signature); // rejects 0 and high-s
require(s == signer, "bad sig");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0046 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.