Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.