If the oauth wall is managed by PHP, then it looks like the answer is yes, you’re vulnerable to client connections that haven’t logged in.

This looks like a bug in PHP’s assembly of multipart responses & you can feed one of those to the PHP backend with a simple web request, no auth required I think.

If the backend can be reached, yes.

If you put the oauth wall in front of the application before it can even reach PHP (i.e. in your nginx/caddy/apache config), then no, assuming all paths are covered.

Probably yes

If anyone can login, probably yes. If only trusted people can, probably no.