It wasn't oauth, it was a normal facebook login. The application didn't fake anything, but simply extracted the session cookie after login.