I agree with you, but here the problem is not the extract() call as everyone here seems to imply.
The security problem lies in the fact that the authentication code is conditionally called depending on user input.
if ($login) { … }
if ($_POST['c99shcook']['login']) { … }