An auth bypass from an empty-object login token sounds like someone checked if the token existed but never checked what was actually in it.