It follows from how Merkle-Damgard hashes keep their internal state. HMAC is the standard fix.
Length extension attack
An attack on hashes like SHA-256 where knowing H(secret||msg) lets you compute H(secret||msg||extra) without the secret.
It follows from how Merkle-Damgard hashes keep their internal state. HMAC is the standard fix.