The integration that compared password hashes directly

A single sign-on bridge that read the stored hash and compared it, which stopped working when the algorithm changed.

// what it did, since 2018
if ( $user->user_pass === md5( $incoming ) ) { /* ... */ }

// which was already wrong — WordPress has not used
// bare md5 since 2008; the value is a phpass hash and
// this comparison had been failing silently, falling
// through to a second code path nobody had noticed.

// what it should be, and now is
if ( wp_check_password( $incoming, $user->user_pass, $user->ID ) ) { }

The comparison had never worked and the fallback path had been doing the authentication for seven years, which is the finding — a broken branch that is never taken is indistinguishable from a working one. wp_check_password also handles the rehash on success, which is the mechanism the bcrypt migration depends on and which this integration was bypassing.