Why is authenticated CFB mode insecure?
One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message.

This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the corresponding ciphertext $(C_1, C_2, ..., C_n, T)$ (using some IV; we don't care what it is).

Here is how the attacker can generate a ciphertext that would decrypt and validate to $(P_1, P_2, ..., P_k)$ for a $k$ of his choosing.

First of all, he can truncate the ciphertext $(C_1, C_2, ..., C_k)$; that will obviously decrypt into the message he wants; all he needs to do is compute the corresponding tag so that it would validate.

He can do this because we already knows that $C_{k+1} = E(C_k) \oplus P_{k+1}$; this is how CFB mode works.  Because of this, he can then compute the tag:

$T' = C_{k+1} \oplus P_1 \oplus P_2 \oplus ... \oplus P_k \oplus P_{k+1} = E(C_k) \oplus P_1 \oplus P_2 \oplus ... \oplus P_k$

And there, his job is done...