[Disasterpiece]

OK, without going into greater details of your code, here are a few things which popped up while I was reading your snippet:

PHP Code:

if ($customer_id && !$vbulletin->GPC[COOKIE_PREFIX . 'userid']) { 


looks strange. Generally, you shouldn't trust user-data, cookies included. If you're looking for info if the user is logged in or not, try the $vbulletin->session var, it's more trustworthy, since I could modify my cookies without actually being logged in and vice-versa under certain circumstances.

PHP Code:

$row_user = mysql_fetch_array(mysql_query("SELECT userid, salt FROM user WHERE userid = '$userid'")); 


You should not assume, that each user-tables of your two different cms/forum systems have the same ID. Primary IDs, like userid is, increase with every entry.
To create a more flexible script, you should create an additional table which connects $customer_id to a vbulletin $userid so the connection between two user-entries is more accurate. how you determine if two users are equal can you decide like testing usernames and passwords / ips etc.