A Merkle–Damgård digest is the full internal state after the last block, so an attacker can load it and keep hashing. If a service authenticates requests with SHA-256(secret ‖ params), anyone who sees one valid tag can append &admin=1 (after the padding bytes) and compute a valid tag for the longer message. Flickr's MD5-based API signatures fell to exactly this in 2009.
Not affected: HMAC (the outer hash hides the inner state), SHA-3 and the SHAKE functions (the capacity is never output), BLAKE2 and BLAKE3, and truncated SHA-2 variants such as SHA-384 and SHA-512/256, whose output omits part of the state. Signature schemes hash the message before signing and are not affected.
The rule is simple: never build a MAC as hash(key ‖ message) from SHA-1 or SHA-256; use HMAC, KMAC or a keyed BLAKE2.