Researchers found a bug that allowed someone with access to a phone number to bypass Google's two-step authentication process and reset passwords for Gmail accounts.