An attacker could form the message N=(M,X), that is, M followed by X. The keyed hash of the new message N is

      H(K, N) = H(H(K, M), X),

which the attacker can compute without knowledge of K. The receiver has no way to detect that the message has been changed.