CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.