Facebook and MySpace have fixed major vulnerabilities that would have allowed attackers full access to accounts that enabled automatic-login.