Why is this MAC flawed? Consider a function to create a tamperproof cookie as follows:

$$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$

where $m$ is a message provided by Alice, and k is a secret key known only to Bob. Bob receives m from Alice and returns the cookie to her. $\text{hash}(m \oplus k)$ functions as a MAC.

Why doesn't this properly authenticate the cookie? What's wrong with the MAC?
To supplement the other answer, I will show that the proposed scheme cannot be shown secure assuming only collision resistance of the hash function. (I.e., the  standard assumption on hash functions.) 

Let $H' : \{0,1\}^* \to \{0,1\}^{\ell-1}$ be a collision resistant hash function. We construct another hash function $H : \{0,1\}^* \to \{0,1\}^{\ell}$ as follows:
$$ H(x\|b) := H'(x)\|b,$$
where $b$ denotes the last bit of the input.

It is easy to see that $H$ must be collision resistant whenever $H'$ is collision resistant. This is because any collision in $H$ trivially (and by construction) must also yield a collision in $H'$.

If you, however, instantiate your proposed MAC construction with $H$, we end up with a scheme that is existentially forgeable under a known message attack. Suppose an adversary receives a message $m$ and a tag $t=H(k\oplus m)$.

Let $k = k'\|b_k$, $m=m'\|b_m$ $t=t'\|b_t$ where $b_k,b_m$ and $b_t$ are bits. Then by construction of $H$ we have

\begin{align*}
t=&amp;\ H\bigl((k'\|b_k) \oplus (m'\|b_m)\bigr)\\
=&amp;\ H\bigl((k'\oplus m') \| (b_k\oplus b_m)\bigr)\\
=&amp;\ H'(k'\oplus m')\|(b_k\oplus b_m).
\end{align*} 

This means, that the adversary can simply output $m^*=m'\|(b_m\oplus 1)$ and $t^*=t'\|(b_t\oplus 1)$ as a forgery. This will verify, since 

\begin{align*}
H(k\oplus m^*)=&amp;\ H\bigl((k'\|b_k) \oplus (m'\|(b_m\oplus 1))\bigr)\\
=&amp;\ H\bigl((k'\oplus m') \| (b_k\oplus b_m\oplus 1)\bigr)\\
=&amp;\ t'\|(b_t\oplus 1).
\end{align*}