A security hole that is two years old is being exploited by scammers.

“If the front gate of your castle is your login page to Yahoo Mail, they’ve done a good job of securing it,” said Ryan Barnett of Breach Security regarding a backdoor that exists due to Yahoo’s failure to carry out a variety of security checks that follows the login page of Yahoo Mail. Barnett told Yahoo about the hole in 2007.

The article also notes that the company also has no rules barring weak passwords for its users.
“Yahoo! takes online security very seriously. We are investigating the situation and will take appropriate action,” said a company spokesman.

Source: The Register