Mtproto did have. Mtproto 2.0 hasnhasn't seen such vulnerability. Reporters are still on the older method as that's what creates an effective login.

One thing I know is that it was possible in mtproto 1.0 to append something to a packet and have a client still accept it. This didn't allow anyone to modify the contents of the packet or see its plaintext. This was possible because the plaintext hash (the one in header, used to verify packet integrity after decryption) didn't include the padding. In mtproto 2.0, the hash is sha256 instead of sha1, and it does include the padding.