Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form via an iframe into the website of A (or B/C) where the user puts in his credentials. (A/B/C are hosted under their own, unrelated domain.) Then the user clicks login and if the credentials for X are correct, he is authentificated for website A (or B/C). Alternatively he can click to open a new window from an URL from website X and enter his credentials there (he has to do this for every login).
In my opinion an attacker could make a website like a gaming forum G faking to use X for authentification and fake the iframe and send the entered credentials from user U to his own server and use the credentials of U to authentificate himself at A/B/C as U. U has no clue that they will be used to authentificate against A and not against G as they are the same and A and G are unrelated.
I told X about this but they just answered that entering the credentials outside their own website (outside includes the iframe) would be against their terms of usage but would have to use the new window version and so they don't consider it a security hole. It didn't matter that I showed them prove that nobody used the new window version in the last months (including their own staff).
Therefore I want to know if there is a guideline whether this is considered (in)secure?
(X is mostly used by websites in the areas of HIPA, financial data, sensitive personal information and X promotes himself as very secure for those but also normal areas)
Edit: I don't want to use the framework but I am a (forced) user like many others of the websites A and B and data about me are stored on C and concerned about my security and the security of my data.