Strange MAC algorithm
We can attack the MAC defined by: MAC(k,m)=MD5(m||k), in a chosen-messages setup, basically because MD5's collision-resistance is broken.

The adversary chooses m and m' of the same length $b\ge64$ bytes, differing only in their first $\lfloor b/64\rfloor$ 64-byte blocks, such that there is a collision after hashing these blocks of m and m'. If follows that MAC(k,m)=MAC(k,m'), and also MAC(k,m||m")=MAC(k,m'||m") for any m". We know various efficient techniques to create such m and m', with $b$ down to 128 or even 64 bytes, including with a moderate degree of constraints:


Xiaoyun Wang, Dengguo Feng, Xuejia Lai, Hongbo Yu: Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD (rump session of Crypto 2004, and in Cryptology ePrint Archive)
Xiaoyun Wang, Hongbo Yu: How to Break MD5 and Other Hash Functions (in proceedings of Eurocrypt 2005)
Vlastimil Klima: Tunnels in Hash Functions: MD5 Collisions Within a Minute (in Cryptology ePrint Archive, 2006)
Marc Stevens: Single-block collision attack on MD5 (in Cryptology ePrint Archive, 2012, and here with code and example)
Tao Xie, Fanbao Liu and Dengguo Feng: Fast Collision Attack on MD5 (in Cryptology ePrint Archive, 2013)




If instead of MD5 we had an unbroken Merkle-Damgård hash like SHA-256, or a hash secure in the random oracle model (which SHA-256 is not quite, for it has the length-extension property), then we'd basically have no known attack, as discussed in this question.