TidBITS explains the Apple’s two factor fail: WebObjects.

Link. AppleID infrastructure is old and barely works. I have seen that in other contexts.