Nearest I can tell... the client app is trusting the user ID sent back to it so you can login with your own (the hacker) user name and password and then replace

Nearest I can tell... the client app is trusting the user ID sent back to it so you can login with your own (the hacker) user name and password and then replace the userid in the returned value with your victims and many mobile apps will let you continue assuming you are the victim.