Tag authentication bypass flaws