Flaws in the mobile site were leaving users vulnerable to attackers who could have reset their user passwords and hijacked their accounts.